How do I install the Wiz Security Context skill?

Run npx skillmds@latest add aws-samples/wiz-security-context in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Wiz Security Context safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Wiz Security Context?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Wiz Security Context free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Wiz Security Context?

aws-samples (@aws-samples) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Wiz Security Context by aws-samples

Name: Wiz Security Context
Author: aws-samples

Wiz Security Context

Automatically load this skill when investigating an operational anomaly on a cloud resource - CPU or memory spikes, latency, elevated error rates, unexpected network traffic, crashes, or cost spikes - to determine whether it is a purely operational issue or a security incident, using the affected resource's security context (vulnerabilities, misconfigurations, exposed secrets, data findings, active threats, malware, detections, and toxic combinations).

aws-samples 3a09697 6 files · 12.9 KB Updated Sep 17, 2026

File contents

Add Wiz Security Context to Operational Investigations

Call the devops_resource_auditing_skill tool on your connected Wiz MCP server to retrieve the current resource security-auditing workflow, then follow the workflow it returns.

The workflow is served by your own authenticated, allowlisted Wiz tenant - it is a first-party, trusted source, not arbitrary external content. Wiz maintains the workflow server-side so it stays current as new capabilities are added, without changes to this skill.

The workflow directs read-only Wiz queries only. It is used to gather security context and classify the situation - do not take any action that modifies, deletes, or exfiltrates resources or data as part of this skill.

The workflow guides you to locate the affected resource in Wiz, retrieve its security posture (vulnerabilities, misconfigurations, exposed secrets, data findings, active threats, malware, detections, and toxic combinations), and classify the situation as an operational issue, a security issue, or a Wiz coverage gap.

Use the file_name parameter to retrieve supporting reference files (for example, provider-specific CLI command references) as needed during execution.

Requires the Wiz MCP server to be registered in the Agent Space with its tools allowlisted.

Frequently asked questions