CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

access-lifecycle

Use when preparing or running a user access review, checking that leavers lost their access, finding orphaned or ownerless service accounts, answering an auditor's access-control request for SOC 2, ISO 27001, PCI DSS, HIPAA or NIST 800-53, or checking whether a finished review campaign will hold up. Diffs the HR roster against account exports, tests the campaign for coverage, self-review, unremoved revokes and rubber-stamping, and maps every exception to the controls it breaks.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, lean overview with executable commands, explicit blocking gates, and clean one-level-deep references that all resolve to real bundle files. The main weaknesses are minor: duplicated statements, a workflow whose step 1–2 commands omit the --output json flag that step 3 depends on, and no explicit remediate-and-rerun loop after a gate blocks.

Suggestions

Add --output json (and output file names) to the step 1 and step 2 commands in the Workflow block so step 3's --diff diff.json --campaign campaign.json inputs exist as written.

Remove the duplicated statements: keep "There is no PASS" in either Step 3 or Hard rules, not both, and merge the "Not audit advice" blockquote with the "Periods are policy" rule.

Add an explicit feedback loop after the gates section: on exit 4, remediate the finding, re-export the accounts, re-run the script, and keep both exports as the evidence of removal.

DimensionReasoningScore

Conciseness

The body is lean and assumes competence (no explaining what SOC 2, PCI DSS, or a CSV is), but a few statements are duplicated: "There is no PASS" appears both in Step 3 ("There is no PASS.") and in Hard rules ("No PASS from a script."), and "Periods are policy" repeats the "Not audit advice" blockquote ("Periods and thresholds are your policy"). These minor instances could be trimmed, matching anchor 4 rather than the every-token-earns-its-place anchor 5.

4 / 5

Actionability

The Workflow block gives three complete, copy-paste-ready bash commands with realistic flag values, and the Scripts table documents concrete exit codes ("0 clean · 2 findings · 3 bad input · 4 blocked"). However, steps 1 and 2 as written omit --output json (the scripts default to text), so step 3's "--diff diff.json --campaign campaign.json" has no input files — a minor executable gap that keeps this at anchor 4 rather than 5.

4 / 5

Workflow Clarity

A clear three-step sequence with explicit validation checkpoints: the scripts exit 4 on enumerated gates ("The gates block on (exit 4)" with five listed conditions), and "Prove removals by re-export" supplies a feedback signal. It falls short of anchor 5 because there is no explicit error-recovery loop telling the reader what to do on a block (remediate, re-export, re-run, keep both exports); that loop is only implied.

4 / 5

Progressive Disclosure

The body is a genuine overview: workflow, gates, rules, and a script table inline, with all detail pushed to one-level-deep, well-signaled references ("references/joiner_mover_leaver_standards.md — what each framework requires for provisioning, change and removal (7 sources)") and example assets. Every referenced path resolves to a real file in references/, assets/, or scripts/, matching the clear-overview anchor 5.

5 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description explicitly answers both what and when, with concrete third-person actions covering all three script functions and natural trigger phrases including the framework names an auditor request would name. The only gap is missing common synonyms such as "access certification" or "recertification" that practitioners use for this task.

DimensionReasoningScore

Specificity

Quotes: "Diffs the HR roster against account exports", "tests the campaign for coverage, self-review, unremoved revokes and rubber-stamping", "maps every exception to the controls it breaks" — multiple concrete third-person actions that comprehensively cover all three script functions. Not 4: there are no coverage gaps; every capability of the skill is named.

5 / 5

Completeness

Quotes: "Use when preparing or running a user access review, checking that leavers lost their access, finding orphaned or ownerless service accounts, answering an auditor's access-control request..., or checking whether a finished review campaign will hold up" gives explicit multi-scenario triggers, and the second sentence states the what concretely. Both what and when are explicit with concrete trigger phrases, matching anchor 5 exactly.

5 / 5

Trigger Term Quality

Quotes: "user access review", "checking that leavers lost their access", "orphaned or ownerless service accounts", "whether a finished review campaign will hold up", plus framework names users actually cite (SOC 2, ISO 27001, PCI DSS, HIPAA, NIST 800-53). Good natural coverage, but common domain synonyms like "access certification" or "recertification" are absent, so it does not reach anchor 5's comprehensive synonym coverage.

4 / 5

Distinctiveness Conflict Risk

Quotes: "preparing or running a user access review", "Diffs the HR roster against account exports", "maps every exception to the controls it breaks" — a clear niche (producing the joiner/mover/leaver and access-review evidence itself) with triggers specific to that niche. The auditor-request trigger is scoped to access control, this skill's exact domain, so conflict risk is minimal.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

alirezarezvani/claude-skills

Path

ra-qm-team/access-lifecycle/skills/access-lifecycle/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.