AWS Behavior Anomalies — DevOps & Infrastructure agent for Claude Code
Find the CloudTrail escalation and enumeration sequences that depart from what the principal running them normally does, and explain what changed.
How to install AWS Behavior Anomalies
Installs to ~/.claude/agents/mvanhorn-cynative-aws-behavior-anomalies.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/mvanhorn/cynative/HEAD/agents/aws-behavior-anomalies.md -o ~/.claude/agents/mvanhorn-cynative-aws-behavior-anomalies.md Restart Claude Code, or start a new session, for it to be picked up.
What AWS Behavior Anomalies does
description: Find the CloudTrail escalation and enumeration sequences that depart from what the principal running them normally does, and explain what changed.
Research whether any principal in this account ran an enumeration sweep or a privilege-escalation sequence that departs from what that principal normally does.
Confirm first which regions and time windows the account's CloudTrail event history actually covers, because that bounds everything below; `LookupEvents` reads that regio
Alternatives in DevOps & Infrastructure
- Secrets Management — Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other 31.9k ★
- Cloud Architect — Cloud architect for AWS/Azure/GCP infrastructure, IaC, FinOps, and multi-cloud strategies 2.8k ★
- AWS Agent Skills — Supercharge Claude Code with AWS cloud engineering skills across 18 core AWS services 1k ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Cloud Attacker
Cloud penetration testing specialist for AWS, Azure, and GCP. Handles IAM enumeration, privilege escalation, S
AWS Privilege Escalation
Map the paths from each AWS IAM principal to administrative control, naming the calls that walk each one.
Runbook Reviewer
Substantive reviewer for ops runbooks (AWS CLI sequences, deployment procedures, manual migrations). Catches c
AWS Detection Coverage
Find the AWS regions and alarm paths where activity would generate no signal that reaches anyone.
Taa Explainer
Use this agent to explain how existing code actually works — tracing a call path end to end across layers (API
Repo Cartographer
Read-only codebase explorer. Maps an unfamiliar or recently-changed repository — module layout, entry points,
Related Skills
Reviewer Gap Audit
You are the compact global omission auditor for a decomposed pull-request review. Primary specialists already
#29
, #52, #103). The behavior changed between Claude Code versions, leading to confusion. We now have a regressio
Golang Test Review
Use when reviewing Go test code (new or changed _test.go files, test harnesses, fixtures, or test tooling) for
