AWS bedrock-agentcore documentation change
Summary
Added documentation for adding skills via AgentCore CLI and TUI interface, including Git repository and S3 bucket sources with authentication details
Security assessment
The changes document authentication requirements for private Git repositories using credentials and S3 access controls, which are security features. However, there is no evidence of a specific security vulnerability being addressed.
Diff
diff --git a/bedrock-agentcore/latest/devguide/harness-skills.md b/bedrock-agentcore/latest/devguide/harness-skills.md index c517a9669..0b803710d 100644 --- a//bedrock-agentcore/latest/devguide/harness-skills.md +++ b//bedrock-agentcore/latest/devguide/harness-skills.md @@ -27,0 +28,4 @@ You can set `skills` as a default on the harness (via `CreateHarness` or `Update +###### Note + +To add a skill to a harness interactively, run `agentcore` to open the TUI, select **add** , choose **Harness** , advance to **Advanced settings** , and enable **Skills** . The wizard then prompts for the skill source. See the **Interactive** tab under Git and Amazon S3 below for the per-source steps. + @@ -62,7 +65,0 @@ Or at invoke time: -AgentCore CLI - - - - agentcore create --name ops-agent --skills aws - agentcore deploy - @@ -145,0 +143,46 @@ Private repository (requires a personal access token stored in [AgentCore Identi +AgentCore CLI + + +Attach a skill from a public Git repository with `agentcore add skill`. Use `--git-path` to pull a single skill from a subdirectory: + + + agentcore add skill --harness my-harness \ + --git https://github.com/anthropics/skills \ + --git-path skills/docx + agentcore deploy + +For a private repository, pass `--credential` with the name of an API key credential in your project that holds a personal access token (`--username` is optional, default `oauth2`): + + + agentcore add skill --harness my-harness \ + --git https://github.com/my-org/internal-skills \ + --git-path excel \ + --credential my-github-pat + agentcore deploy + +###### Note + +Remove a skill with `agentcore remove skill` using the same source flags. To override skills for a single call without changing the harness, use `agentcore invoke --skills <sources>` (comma-separated paths, `s3://` URIs, or `https://` Git URLs); Git authentication is not supported on the invoke override. + +Interactive + + +In the TUI, add a Git skill to a harness through the **add** → **Harness** wizard. + + 1. Advance to **Advanced settings** , move to **Skills** , and press **Space** to enable it, then press **Enter** . + + + + 2. Select **Git** as the skill source. + + + + 3. Enter the HTTPS repository URL. The wizard then prompts for an optional subdirectory path, an optional credential for private repositories, and an optional username. + + + + + + +Confirm the wizard, then run `agentcore deploy` to apply. + @@ -177,0 +221,26 @@ AWS CLI/boto3 +AgentCore CLI + + +Attach a skill from S3 with `agentcore add skill --s3`: + + + agentcore add skill --harness my-harness \ + --s3 s3://my-skills-bucket/skills/company-style/ + agentcore deploy + +The execution role needs `s3:GetObject` and `s3:ListBucket` on the bucket. See [Security and access controls](./harness-security.html). + +Interactive + + +In the TUI, add an S3 skill to a harness through the **add** → **Harness** wizard. Advance to **Advanced settings** , enable **Skills** with **Space** , and choose **S3** as the source (see the Git Interactive tab for those shared steps). + + 1. Enter the S3 URI of the skill directory. + + + + + + +Confirm the wizard, then run `agentcore deploy` to apply. +