aws-iam-enum

Enumerate AWS IAM policies, detect privilege escalation paths per Rhino Security Labs canonical 21 primitives.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/aws-iam-enum/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably concise and well-structured with concrete, mostly executable guidance, but it lacks validation/feedback checkpoints for a batch, potentially destructive enumeration workflow, which caps workflow clarity. Placeholder tokens in two steps slightly reduce copy-paste actionability.

Suggestions

Add explicit validation checkpoints to the sequence, e.g., confirm `aws sts get-caller-identity` succeeds and IAM read permissions exist before iterating attached policies, and verify each policy version resolved before running the audit.

Replace placeholder tokens (ARN, VID, <vuln>, <crown_jewel>) with concrete capture patterns or a short note on how to substitute real values, so the policy-audit and graph-promotion steps are copy-paste ready.

Include a brief verify step after the privesc-primitive scan (e.g., 'confirm each matched Allow before promoting to the graph as a vulnerability') to close the feedback loop before graph promotion.

Dimension	Reasoning	Score
Conciseness	The 60-line body is lean and assumes Claude's competence: it skips any explanation of what IAM is or how the privesc primitives work, presenting only commands, the canonical 21-path list, and minimal chain notes, so every token earns its place.	5 / 5
Actionability	It provides mostly executable AWS CLI commands and a concrete 21-primitive checklist, but the policy-audit and graph-promotion steps use pseudocode tokens like ARN, VID, and `<vuln>` that are placeholders rather than copy-paste-ready, leaving minor gaps.	4 / 5
Workflow Clarity	The five numbered sections give a clear sequence, but a destructive/batch security-enumeration workflow has no validation checkpoints or feedback loops (e.g., verifying IAM read access before iterating, confirming a policy version resolved before auditing), so per the rubric feedback-loop rule workflow clarity is capped at 3.	3 / 5
Progressive Disclosure	For a sub-50-line-equivalent single-purpose skill with no bundle files (references/scripts/assets absent), the well-organized section structure (Identity, Attached policies, Privesc primitives, Graph promotion, Common chains) fully satisfies the simple-skill exception for progressive disclosure at 5.	5 / 5
	Total	17 / 20 Passed

Description

51%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and well-targeted to a recognizable security niche, but it lacks an explicit 'Use when...' trigger clause, relying on metadata for activation guidance, which caps completeness. Trigger-term coverage is adequate but could include more natural synonyms.

Suggestions

Add an explicit 'Use when...' clause to the description (e.g., 'Use when auditing AWS IAM permissions, enumerating user/role policies, or hunting for privilege escalation chains') so the when-trigger lives in the description field, not only in metadata.

Expand natural trigger terms to include synonyms a user would actually say, such as 'IAM permissions audit', 'policy review', 'privesc scan', and 'AWS privilege escalation'.

Reflect the full scope of the body in the description (policy retrieval + primitive matching + graph promotion) rather than only 'enumerate' and 'detect'.

Dimension	Reasoning	Score
Specificity	The description names the domain (AWS IAM policies) and two concrete actions ('Enumerate', 'detect privilege escalation paths'), which matches the anchor listing domain plus 1-2 concrete actions, but it stops short of enumerating the actual capabilities the body covers (policy retrieval, primitive matching, graph promotion).	3 / 5
Completeness	It gives a clear 'what' (enumerate policies, detect privesc paths) but there is no explicit 'Use when...' or equivalent trigger clause in the description itself; the when guidance lives only in metadata.when_to_use, so per the rubric a missing explicit trigger clause caps completeness at 3.	3 / 5
Trigger Term Quality	It surfaces some natural terms a user might say ('AWS IAM', 'privilege escalation', 'privesc') but misses common variations and synonyms a requester would naturally use, such as 'IAM permissions', 'policy audit', 'privesc scan', or file/service extensions.	3 / 5
Distinctiveness Conflict Risk	The phrase 'Rhino Security Labs canonical 21 primitives' carves out a clear niche tied to a specific framework, making it mostly distinct from generic IAM or cloud skills with only minor overlap risk against other AWS enumeration skills.	4 / 5
	Total	13 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning

	Total	14 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/cloud/aws-iam-enum/SKILL.md
Commit: 0cf691e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.