Skill: ivangdavila/aws (version 1.0.2)

--- name: AWS | Amazon Web Services slug: aws version: 1.0.2 homepage: https://clawic.com/skills/aws description: Architect, deploy, and optimize AWS infrastructure avoiding cost explosions and security pitfalls. changelog: Complete rewrite with cost traps, security hardening, service selection metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["aws"]},"install":[{"id":"brew","kind":"brew","formula":"awscli","bins":["aws"],"label":"Install AWS CLI (Homebrew)"}],"os":["linux","darwin","win32"]}} --- ## Setup On first use, read `setup.md` for integration options. The skill works immediately — setup is optional for personalization. ## When to Use User needs AWS infrastructure guidance. Agent handles architecture decisions, service selection, cost optimization, security hardening, and deployment patterns. ## Architecture Memory lives in `~/aws/`. See `memory-template.md` for structure. ``` ~/aws/ ├── memory.md # Account context + preferences ├── resources.md # Active infrastructure inventory └── costs.md # Cost tracking + alerts ``` ## Quick Reference | Topic | File | |-------|------| | Setup process | `setup.md` | | Memory template | `memory-template.md` | | Service patterns | `services.md` | | Cost optimization | `costs.md` | | Security hardening | `security.md` | ## Core Rules ### 1. Verify Account Context First Before any operation, confirm: - Region (default: us-east-1, but ask) - Account type (personal/startup/enterprise) - Existing infrastructure (VPC, subnets, security groups) ```bash aws sts get-caller-identity aws ec2 describe-vpcs --query 'Vpcs[].{ID:VpcId,CIDR:CidrBlock,Default:IsDefault}' ``` ### 2. Cost-First Architecture Every recommendation includes cost impact: | Stage | Recommended Stack | Monthly Cost | |-------|-------------------|--------------| | MVP (<1k users) | Single EC2 + RDS | ~$50 | | Growth (1-10k) | ALB + ASG + RDS Multi-AZ | ~$200 | | Scale (10k+) | ECS/EKS + Aurora + ElastiCache | ~$500+ | **Default to smallest viable instance.** Scaling up is easy; scaling down wastes money. ### 3. Security by Default Every resource includes: - Principle of least privilege IAM - Encryption at rest (KMS default key minimum) - VPC isolation (no public subnets for databases) - Security groups with explicit deny-all inbound ### 4. Infrastructure as Code Generate Terraform or CloudFormation for reproducibility: ```bash # Prefer Terraform for multi-cloud portability terraform init && terraform plan ``` Never rely on console-only changes. ### 5. Tagging Strategy Every resource gets tagged for cost allocation: ```bash --tags Key=Environment,Value=prod Key=Project,Value=myapp Key=Owner,Value=team ``` ### 6. Monitoring from Day 1 Deploy CloudWatch alarms with infrastructure: - Billing alerts (before you get surprised) - CPU/Memory thresholds - Error rate spikes ## Cost Traps **NAT Gateway data processing ($0.045/GB):** VPC endpoints are free for S3/DynamoDB. A busy app can burn $500/month on NAT alone. ```bash aws ec2 create-vpc-endpoint --vpc-id vpc-xxx \ --service-name com.amazonaws.us-east-1.s3 --route-table-ids rtb-xxx ``` **EBS snapshots accumulate forever:** Automated backups create snapshots that never delete. Set lifecycle policies. ```bash aws ec2 describe-snapshots --owner-ids self \ --query 'Snapshots[?StartTime<=`2024-01-01`].[SnapshotId,StartTime,VolumeSize]' ``` **CloudWatch Logs default retention is forever:** ```bash aws logs put-retention-policy --log-group-name /aws/lambda/fn --retention-in-days 14 ``` **Idle load balancers cost $16/month minimum:** ALBs charge even with zero traffic. Delete unused ones. **Data transfer between AZs costs $0.01/GB each way:** Chatty microservices across AZs add up fast. Co-locate when possible. ## Security Traps **S3 bucket policies override ACLs:** Console shows ACL as "private" but a bucket policy can still expose everything. ```bash aws s3api get-bucket-policy --bucket my-bucket 2>/dev/null || echo "No policy" aws s3api get-public-access-block --bucket my-bucket ``` **Default VPC security groups allow all outbound:** Attackers exfiltrate through outbound. Restrict it. **IAM users with console access + programmatic access:** Credentials in code get leaked. Use roles + temporary credentials. **RDS publicly accessible defaults to Yes in console:** Always verify: ```bash aws rds describe-db-instances --query 'DBInstances[].{ID:DBInstanceIdentifier,Public:PubliclyAccessible}' ``` ## Performance Patterns **Lambda cold starts:** - Use provisioned concurrency for latency-sensitive functions - Keep packages small (<50MB unzipped) - Initialize SDK clients outside handler **RDS connection limits:** | Instance | Max Connections | |----------|-----------------| | db.t3.micro | 66 | | db.t3.small | 150 | | db.t3.medium | 300 | Use RDS Proxy for Lambda to avoid connection exhaustion. **EBS volume types:** | Type | Use Case | IOPS | |------|----------|------| | gp3 | Default (consistent) | 3,000 base | | io2 | Databases (guaranteed) | Up to 64,000 | | st1 | Big data (throughput) | 500 MiB/s | ## Service Selection | Need | Service | Why | |------|---------|-----| | Static site | S3 + CloudFront | Pennies/month, global CDN | | API backend | Lambda + API Gateway | Zero idle cost | | Container app | ECS Fargate | No cluster management | | Database | RDS PostgreSQL | Managed, Multi-AZ ready | | Cache | ElastiCache Redis | Session/cache, < DynamoDB latency | | Queue | SQS | Simpler than SNS for most cases | | Search | OpenSearch | Elasticsearch managed | ## CLI Essentials ```bash # Configure credentials aws configure --profile myproject # Always specify profile export AWS_PROFILE=myproject # Check current identity aws sts get-caller-identity # List all regions aws ec2 describe-regions --query 'Regions[].RegionName' # Estimate monthly cost aws ce get-cost-forecast --time-period Start=$(date +%Y-%m-01),End=$(date -v+1m +%Y-%m-01) \ --metric UNBLENDED_COST --granularity MONTHLY ``` ## Security & Privacy **Credentials:** This skill uses the AWS CLI, which reads credentials from `~/.aws/credentials` or environment variables. The skill never stores, logs, or transmits AWS credentials. **Local storage:** Preferences and context stored in `~/aws/` — no data leaves your machine. **CLI commands:** All commands shown are read-only by default. Destructive operations (delete, terminate) require explicit user confirmation. ## Related Skills Install with `clawhub install <slug>` if user confirms: - `infrastructure` — architecture decisions - `cloud` — multi-cloud patterns - `docker` — container basics - `backend` — API design ## Feedback - If useful: `clawhub star aws` - Stay updated: `clawhub sync`

path: costs.md
content: # AWS Cost Optimization

## Cost Monitoring Setup

### Billing Alerts (Do This First)
```bash
# Enable billing alerts (one-time, in us-east-1)
aws ce put-anomaly-subscription --subscription-name cost-alerts \
  --threshold 50 --frequency DAILY

# Create budget
aws budgets create-budget --account-id $(aws sts get-caller-identity --query Account --output text) \
  --budget '{
    "BudgetName": "Monthly",
    "BudgetLimit": {"Amount": "100", "Unit": "USD"},
    "TimeUnit": "MONTHLY",
    "BudgetType": "COST"
  }' \
  --notifications-with-subscribers '[{
    "Notification": {"NotificationType": "ACTUAL", "ComparisonOperator": "GREATER_THAN", "Threshold": 80},
    "Subscribers": [{"SubscriptionType": "EMAIL", "Address": "[REDACTED_SECRET]"}]
  }]'
```

### Cost Explorer
```bash
# Last 30 days by service
aws ce get-cost-and-usage \
  --time-period Start=$(date -v-30d +%Y-%m-%d),End=$(date +%Y-%m-%d) \
  --granularity MONTHLY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE
```

## Top Cost Traps

### 1. NAT Gateway Data Processing
**$0.045/GB processed** — adds up silently.

**Fix:** Use VPC endpoints for S3/DynamoDB (free):
```bash
aws ec2 create-vpc-endpoint --vpc-id vpc-xxx \
  --service-name com.amazonaws.us-east-1.s3 --route-table-ids rtb-xxx
```

### 2. Idle Load Balancers
**$16/month minimum** even with zero traffic.

**Find idle ALBs:**
```bash
aws elbv2 describe-load-balancers --query 'LoadBalancers[].LoadBalancerArn' | \
  xargs -I{} aws cloudwatch get-metric-statistics --namespace AWS/ApplicationELB \
  --metric-name RequestCount --dimensions Name=LoadBalancer,Value={} \
  --start-time $(date -v-7d +%Y-%m-%dT%H:%M:%S) --end-time $(date +%Y-%m-%dT%H:%M:%S) \
  --period 604800 --statistics Sum
```

### 3. Unattached EBS Volumes
```bash
# Find orphaned volumes
aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].{ID:VolumeId,Size:Size,Created:CreateTime}'
```

### 4. Old EBS Snapshots
```bash
# Snapshots older than 90 days
aws ec2 describe-snapshots --owner-ids self \
  --query 'Snapshots[?StartTime<=`'$(date -v-90d +%Y-%m-%d)'`].[SnapshotId,VolumeSize,StartTime]'
```

### 5. CloudWatch Logs Forever Retention
```bash
# Find log groups with no retention
aws logs describe-log-groups \
  --query 'logGroups[?!retentionInDays].[logGroupName,storedBytes]'

# Set 14-day retention
aws logs put-retention-policy --log-group-name /aws/lambda/fn --retention-in-days 14
```

### 6. Oversized EC2 Instances
Check CPU utilization — <20% average means oversized:
```bash
aws cloudwatch get-metric-statistics --namespace AWS/EC2 \
  --metric-name CPUUtilization --dimensions Name=InstanceId,Value=i-xxx \
  --start-time $(date -v-7d +%Y-%m-%dT%H:%M:%S) --end-time $(date +%Y-%m-%dT%H:%M:%S) \
  --period 3600 --statistics Average
```

### 7. Cross-AZ Data Transfer
**$0.01/GB each way** between AZs.

**Fix:** Co-locate chatty services in same AZ, or accept the trade-off for availability.

## Savings Strategies

### Reserved Instances (1-3 year commit)
| Term | Payment | Savings |
|------|---------|---------|
| 1 year, no upfront | Monthly | ~30% |
| 1 year, all upfront | One-time | ~40% |
| 3 year, all upfront | One-time | ~60% |

**Only for stable, predictable workloads.**

### Spot Instances (up to 90% off)
Good for:
- Batch processing
- CI/CD workers
- Fault-tolerant workloads

```bash
aws ec2 request-spot-instances --instance-count 1 --type one-time \
  --launch-specification '{"ImageId":"ami-xxx","InstanceType":"t3.medium"}'
```

### Savings Plans
More flexible than RIs — covers EC2, Fargate, Lambda:
```bash
aws savingsplans describe-savings-plans-offerings \
  --product-type EC2_INSTANCE --duration-seconds 31536000
```

### Right-Sizing
Check Compute Optimizer recommendations:
```bash
aws compute-optimizer get-ec2-instance-recommendations
```

## S3 Cost Optimization

### Lifecycle Policies
```bash
aws s3api put-bucket-lifecycle-configuration --bucket my-bucket \
  --lifecycle-configuration '{
    "Rules": [{
      "ID": "Archive old data",
      "Status": "Enabled",
      "Filter": {"Prefix": "logs/"},
      "Transitions": [
        {"Days": 30, "StorageClass": "STANDARD_IA"},
        {"Days": 90, "StorageClass": "GLACIER"}
      ],
      "Expiration": {"Days": 365}
    }]
  }'
```

### Intelligent-Tiering
Auto-moves objects based on access patterns — small monthly fee but hands-off:
```bash
aws s3api put-bucket-intelligent-tiering-configuration --bucket my-bucket \
  --id auto-tier --intelligent-tiering-configuration '{
    "Id": "auto-tier",
    "Status": "Enabled",
    "Tierings": [
      {"Days": 90, "AccessTier": "ARCHIVE_ACCESS"},
      {"Days": 180, "AccessTier": "DEEP_ARCHIVE_ACCESS"}
    ]
  }'
```

## Monthly Cost Review Checklist

| Check | Action |
|-------|--------|
| Idle EC2 instances | Stop or terminate |
| Unattached EBS volumes | Delete |
| Old snapshots | Delete or lifecycle |
| Unused Elastic IPs | Release |
| Oversized instances | Downsize |
| Log retention | Set policies |
| Reserved capacity | Renew or adjust |


path: memory-template.md
content: # Memory Template — AWS

Create `~/aws/memory.md` with this structure:

```markdown
# AWS Memory

## Status
status: ongoing
version: 2.0.0
last: YYYY-MM-DD
integration: pending

## Account Context
<!-- AWS account details learned from conversations -->
<!-- Example: Personal account, us-east-1 primary, ~$100/month budget -->

## Current Infrastructure
<!-- What's deployed, high-level -->
<!-- Example: Single EC2 (t3.small) + RDS PostgreSQL + S3 bucket -->

## Preferences
<!-- How they like to work -->
<!-- Example: Prefers Terraform, wants cost alerts at $50 -->

## Cost Notes
<!-- Budget constraints, past surprises, optimization wins -->

## Notes
<!-- Internal observations -->

---
*Updated: YYYY-MM-DD*
```

## Status Values

| Value | Meaning | Behavior |
|-------|---------|----------|
| `ongoing` | Still learning context | Gather info opportunistically |
| `complete` | Know their setup well | Focus on execution |
| `paused` | User said "not now" | Don't ask, work with what you have |

## Additional Files (Optional)

### resources.md
Track active infrastructure:
```markdown
# AWS Resources

## EC2 Instances
| Name | Type | Region | Purpose |
|------|------|--------|---------|

## RDS Databases
| Name | Engine | Type | Multi-AZ |
|------|--------|------|----------|

## S3 Buckets
| Name | Region | Purpose |
|------|--------|---------|

---
*Updated: YYYY-MM-DD*
```

### costs.md
Track spending:
```markdown
# AWS Costs

## Monthly Tracking
| Month | Actual | Budget | Notes |
|-------|--------|--------|-------|

## Alerts Set
- Billing: $X threshold
- Service-specific: ...

## Optimization Wins
<!-- Cost savings achieved -->

---
*Updated: YYYY-MM-DD*
```


path: security.md
content: # AWS Security — Best Practices

## IAM Fundamentals

### Never Use Root Account
```bash
# Create admin user instead
aws iam create-user --user-name admin
aws iam attach-user-policy --user-name admin \
  --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
```

### Principle of Least Privilege
Start with zero permissions, add only what's needed:

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject"],
    "Resource": "arn:aws:s3:::my-bucket/*"
  }]
}
```

### Use Roles, Not Users for Services
```bash
# EC2 instance role (no credentials in code)
aws iam create-role --role-name MyAppRole \
  --assume-role-policy-document file://trust-policy.json
```

## Network Security

### VPC Best Practices

```
┌─────────────────────────────────────────┐
│ VPC (10.0.0.0/16)                       │
│  ┌──────────────┐  ┌──────────────┐     │
│  │ Public       │  │ Private      │     │
│  │ 10.0.1.0/24  │  │ 10.0.2.0/24  │     │
│  │              │  │              │     │
│  │ ALB, NAT     │  │ EC2, RDS     │     │
│  └──────────────┘  └──────────────┘     │
└─────────────────────────────────────────┘
```

- **Public subnet:** Only load balancers, NAT gateways
- **Private subnet:** All application servers, databases
- **No direct internet access** for private resources

### Security Groups

```bash
# Deny all by default, allow specific
aws ec2 create-security-group --group-name web-sg \
  --description "Web servers"

# Allow HTTPS from ALB only
aws ec2 authorize-security-group-ingress --group-id sg-xxx \
  --protocol tcp --port 443 --source-group sg-alb
```

**Key rules:**
- Never allow 0.0.0.0/0 for SSH (use Session Manager)
- Restrict outbound to required ports
- Reference security groups, not IP ranges

### NACLs (Stateless)
Remember: NACLs need explicit return traffic rules.

```bash
# Allow inbound HTTPS
aws ec2 create-network-acl-entry --network-acl-id acl-xxx \
  --rule-number 100 --protocol tcp --port-range From=443,To=443 \
  --cidr-block 0.0.0.0/0 --rule-action allow --ingress

# Allow outbound ephemeral (return traffic)
aws ec2 create-network-acl-entry --network-acl-id acl-xxx \
  --rule-number 100 --protocol tcp --port-range From=1024,To=65535 \
  --cidr-block 0.0.0.0/0 --rule-action allow --egress
```

## Data Protection

### Encryption at Rest
```bash
# S3 bucket encryption
aws s3api put-bucket-encryption --bucket my-bucket \
  --server-side-encryption-configuration '{
    "Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms"}}]
  }'

# RDS encryption (must be set at creation)
aws rds create-db-instance --db-instance-identifier mydb \
  --storage-encrypted --kms-key-id alias/aws/rds ...
```

### Encryption in Transit
- Use HTTPS everywhere (ALB terminates TLS)
- Require TLS for RDS connections
- Use VPC endpoints to avoid public internet

## S3 Security

### Block Public Access (Account-Wide)
```bash
aws s3control put-public-access-block --account-id 123456789012 \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
```

### Bucket Policy Audit
```bash
# Check for public access
aws s3api get-bucket-policy-status --bucket my-bucket
aws s3api get-public-access-block --bucket my-bucket
```

## Secrets Management

### Use Secrets Manager
```bash
# Store secret
aws secretsmanager create-secret --name myapp/db-password \
  --secret-string '{"password":"xxx"}'

# Retrieve in app
aws secretsmanager get-secret-value --secret-id myapp/db-password
```

### Rotate Credentials
Enable automatic rotation for RDS:
```bash
aws secretsmanager rotate-secret --secret-id myapp/db-password \
  --rotation-lambda-arn arn:aws:lambda:...:function:SecretsManagerRotation
```

## Monitoring & Detection

### CloudTrail (Always On)
```bash
aws cloudtrail create-trail --name management-events \
  --s3-bucket-name my-audit-logs --is-multi-region-trail
```

### GuardDuty
```bash
aws guardduty create-detector --enable
```

### Config Rules
```bash
# Example: Detect unencrypted S3 buckets
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-ssl-requests-only",
  "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_SSL_REQUESTS_ONLY"}
}'
```

## Security Checklist

| Check | Command |
|-------|---------|
| MFA on root | Console → Security credentials |
| No root access keys | `aws iam list-access-keys --user-name root` |
| CloudTrail enabled | `aws cloudtrail describe-trails` |
| S3 public blocked | `aws s3control get-public-access-block` |
| Default VPC deleted | `aws ec2 describe-vpcs --filters Name=isDefault,Values=true` |
| No wide-open SGs | `aws ec2 describe-security-groups --query 'SecurityGroups[?IpPermissions[?IpRanges[?CidrIp==\`0.0.0.0/0\`]]]'` |


path: services.md
content: # AWS Services — Quick Reference

## Compute

| Service | Use Case | Pricing Model |
|---------|----------|---------------|
| EC2 | Full control VMs | Per-hour + storage |
| Lambda | Event-driven, <15min | Per-invocation + duration |
| ECS Fargate | Containers, no cluster | Per vCPU/memory-hour |
| EKS | Kubernetes | $0.10/hr + node costs |
| Lightsail | Simple VPS | Fixed monthly |

### When to Use What

```
Need full OS control? → EC2
Short tasks, variable load? → Lambda
Containers, don't want to manage nodes? → Fargate
Already on Kubernetes? → EKS
Just need a simple server? → Lightsail
```

## Database

| Service | Type | Best For |
|---------|------|----------|
| RDS | Relational | PostgreSQL/MySQL workloads |
| Aurora | Relational (AWS) | High availability, auto-scaling |
| DynamoDB | Key-value | High throughput, simple queries |
| ElastiCache | In-memory | Caching, sessions |
| DocumentDB | Document | MongoDB compatibility |

### Database Selection

```
Traditional SQL app? → RDS PostgreSQL
Need auto-scaling reads? → Aurora
Simple key-value, massive scale? → DynamoDB
Caching layer? → ElastiCache Redis
```

## Storage

| Service | Type | Cost/GB/month |
|---------|------|---------------|
| S3 Standard | Object | $0.023 |
| S3 IA | Infrequent | $0.0125 |
| S3 Glacier | Archive | $0.004 |
| EBS gp3 | Block | $0.08 |
| EFS | File (NFS) | $0.30 |

### Storage Selection

```
Static files, backups? → S3
Need filesystem mount? → EFS
Block storage for EC2? → EBS gp3
Archive (rare access)? → Glacier
```

## Networking

| Service | Purpose | Key Cost |
|---------|---------|----------|
| VPC | Network isolation | Free |
| ALB | HTTP load balancing | $0.0225/hr + LCU |
| NLB | TCP/UDP load balancing | $0.0225/hr + LCU |
| CloudFront | CDN | Per-request + transfer |
| Route 53 | DNS | $0.50/zone + queries |
| API Gateway | REST/HTTP APIs | Per-request |

### Load Balancer Selection

```
HTTP/HTTPS traffic? → ALB
Raw TCP/UDP, extreme performance? → NLB
WebSocket? → ALB
gRPC? → ALB (with HTTP/2)
```

## Security & Identity

| Service | Purpose |
|---------|---------|
| IAM | Users, roles, policies |
| Cognito | User authentication |
| Secrets Manager | Rotate credentials |
| KMS | Encryption keys |
| WAF | Web application firewall |
| GuardDuty | Threat detection |

## Messaging & Integration

| Service | Pattern | Use Case |
|---------|---------|----------|
| SQS | Queue | Decouple services |
| SNS | Pub/sub | Fan-out notifications |
| EventBridge | Event bus | Event-driven architecture |
| Step Functions | Orchestration | Complex workflows |

### Messaging Selection

```
Simple job queue? → SQS
Broadcast to many? → SNS
Event routing? → EventBridge
Multi-step workflow? → Step Functions
```

## Observability

| Service | Purpose |
|---------|---------|
| CloudWatch Logs | Log aggregation |
| CloudWatch Metrics | Monitoring |
| CloudWatch Alarms | Alerting |
| X-Ray | Distributed tracing |
| CloudTrail | API audit log |

## Cost Tiers (Typical)

| Tier | Services | Monthly |
|------|----------|---------|
| Free tier | Lambda, DynamoDB, S3 (limits) | $0 |
| Minimal | t3.micro + RDS + S3 | $30-50 |
| Startup | t3.small + RDS + ALB + S3 | $100-200 |
| Growth | ASG + RDS Multi-AZ + ElastiCache | $300-500 |
| Scale | EKS + Aurora + CloudFront | $1000+ |


path: setup.md
content: # Setup — AWS

Read this on first use to understand integration options.

## Your Attitude

AWS can be overwhelming — 200+ services, complex pricing, easy to overspend. You're here to cut through the noise and help them build something that works without burning money.

## Priority Order

### 1. First: Understand Their AWS Context

Early in the conversation, learn:
- "What are you building?" (app type, scale expectations)
- "Do you have an existing AWS account, or starting fresh?"
- "Any hard constraints?" (budget, compliance, region)

This shapes every recommendation. A startup MVP is different from enterprise migration.

### 2. Then: Assess Their Experience Level

Adapt your guidance:
- **New to AWS:** Explain why each service, warn about cost traps proactively
- **Experienced:** Skip basics, focus on optimization and best practices
- **Migrating:** Focus on compatibility and minimal disruption

### 3. Finally: Establish Defaults

Once you understand their context, establish:
- Primary region
- Tagging convention
- Cost alert threshold
- IaC preference (Terraform/CloudFormation/CDK)

## Feedback After Each Response

Don't just answer — connect it to their goals:
1. Answer the immediate question
2. Flag any cost/security implications
3. Suggest the natural next step

## Integration

If the user wants ongoing AWS help, suggest they note it in their preferences. The skill activates when explicitly called or when AWS topics arise in conversation.

## When "Done"

Once you know:
1. What they're building
2. Their AWS experience level
3. Key constraints (budget/compliance/region)

...you're ready to architect. Everything else builds over time.


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (MEDIUM)