huggingface/hf-cloud-aws-context-discovery
skills/hf-cloud-aws-context-discovery/SKILL.md
Discover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like "use my AWS account", "deploy to AWS", "use my profile", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.
$ install --global
skillsauthnpx skillsauth add huggingface/skills hf-cloud-aws-context-discoveryInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 8, 2026, 4:37 AM151.1s1 file scanned
SKILL.md
- name:
- hf-cloud-aws-context-discovery
- description:
- Discover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like "use my AWS account", "deploy to AWS", "use my profile", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.
AWS Context Discovery
Before doing any AWS work, read the user's local AWS config. Don't guess the region, and don't ask the user for things their config already answers.
What to discover
Run these at the start of the AWS work and remember the results for the rest of the session.
1. Active profile
AWS_PROFILE env var, else default. If the user mentioned a profile in their prompt, that overrides. If the named profile doesn't exist in ~/.aws/config, surface that clearly.
2. Region
Resolution order — stop at the first one that produces a value:
- Region the user explicitly named in this conversation
AWS_REGIONenv varAWS_DEFAULT_REGIONenv varregionfield on the active profile in~/.aws/config- Ask the user — but only after the first four have failed
Do not fall back to us-east-1 or any other hardcoded default.
3. Credentials, account ID, caller ARN
aws sts get-caller-identity --profile <profile> --region <region>
Three purposes in one call: confirms credentials are valid (stop if not), returns the Account ID (needed for ARN construction), returns the Arn of the caller.
4. Identify SSO / assumed-role principals
The Arn field tells you what kind of principal this is. The pattern matters because it determines what IAM operations the caller can do.
| ARN pattern | Type | IAM write capability |
|---|---|---|
| arn:aws:iam::<acct>:user/<name> | IAM user | Depends on attached policies |
| arn:aws:sts::<acct>:assumed-role/AWSReservedSSO_<...>/<email> | SSO assumed-role | Typically none — can't create/modify IAM roles |
| arn:aws:sts::<acct>:assumed-role/<role>/<session> | Regular assumed-role | Depends on the role |
If the caller is SSO, surface this immediately before later skills hit iam:CreateRole and fail:
Heads up: you're authenticated via SSO (
AWSReservedSSO_<PermissionSet>_...). SSO principals usually can't create IAM roles directly. If we need a SageMaker execution role, I'll look for an existing one first — if none exists, you'll need to ask whoever manages your AWS access to create one.
This is the highest-leverage thing this skill does. Surfacing it now turns a confusing mid-deployment error into a five-second conversation.
Commands to run
# Effective profile and region (faster than parsing config files)
aws configure list
# Validate credentials and get identity
aws sts get-caller-identity
aws sts get-caller-identity --profile <profile-name> # if a profile was named
aws configure list handles env-var overrides and shows the resolved effective values. Prefer it over parsing ~/.aws/config yourself. If you need to read raw config (e.g. to list profiles), ~/.aws/config and ~/.aws/credentials are plain INI files — read-only.
What to report back
One or two lines, not a wall of text:
Working with profile
my-profileineu-west-1, account123456789012. You're authenticated via SSO, so we'll need to use an existing IAM role rather than create one.
Don't ask the user to confirm the region you just read from their config — they configured it; that is the confirmation.
If something is wrong (credentials expired, profile doesn't exist, no region anywhere), stop and surface the specific error before continuing.
Related Skills
huggingface/train-sentence-transformers
development
VerifiedTrustedOfficial
Train or fine-tune sentence-transformers models across `SentenceTransformer` (bi-encoder, dense or static embedding model for retrieval, similarity, clustering, classification, paraphrase mining, dedup, multimodal), `CrossEncoder` (reranker, pair scoring for two-stage retrieval / pair classification), `SparseEncoder` (SPLADE, sparse embedding model for learned-sparse retrieval), and `MultiVectorEncoder` (ColBERT / late-interaction, per-token embeddings scored with MaxSim). Covers loss selection, hard-negative mining, evaluators, distillation, LoRA, Matryoshka, and Hugging Face Hub publishing. Use for any sentence-transformers training task.
10,942SKILL.mdUpdated May 8, 2026
huggingface/hf-cloud-sagemaker-deployment-planner
devops
VerifiedTrustedOfficial
Plan and coordinate the deployment of a model to Amazon SageMaker AI. Use this skill whenever the user wants to deploy, host, serve, or expose a model on SageMaker or AWS — including phrases like "deploy a model", "host this LLM on AWS", "serve this embedding model", "deploy a reranker", "deploy a text-to-image / diffusion model", "host this for async inference", "create an endpoint", "serve my fine-tuned model", or any request that involves making a model available for inference on AWS. Use this even when the user is vague (e.g. "I just want to get this running on AWS, you figure it out"). Works for text-generation LLMs, embedding models, rerankers, classifiers, text-to-image / diffusion models — picks the right serving stack and chooses between real-time and async inference. This is the entry-point skill for SageMaker deployment work — it asks clarifying questions, picks a deployment pathway, and coordinates the other deployment skills.
10,894SKILL.mdUpdated Jul 8, 2026
huggingface/trl-training
tools
VerifiedTrustedOfficial
Train and fine-tune transformer language models using TRL (Transformers Reinforcement Learning). Supports SFT, DPO, GRPO, KTO, RLOO and Reward Model training via CLI commands.
10,894SKILL.mdUpdated Jun 9, 2026
huggingface/huggingface-spaces
development
VerifiedTrustedOfficial
Build, deploy, and maintain applications on Hugging Face Spaces — Gradio / Docker / Static SDKs, ZeroGPU and dedicated hardware, model loading, debugging, buckets, inference providers, community grants. Use whenever the user asks to create or host an app on Hugging Face, port code onto ZeroGPU, fix a Space that won't build or run, or otherwise work with `hf spaces …`, `@spaces.GPU`, Space README frontmatter, or the `spaces` Python package.
10,894SKILL.mdUpdated Jun 6, 2026