aws-secrets-manager

Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords. Prevents AI agents from directly fetching secret values and teaches runtime dynamic references with asm-exec so plaintext never enters the LLM context window.

Quality

68%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/aws-core/skills/aws-secrets-manager/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable examples and a clear syntax reference, and it largely respects token budget without padding. Its weaker points are the absence of explicit validation checkpoints in the usage workflow and a bundled reference file that is not clearly signaled for navigation.

Suggestions

Add an explicit validation/checkpoint step to the usage workflow (e.g., 'Verify resolution succeeded before relying on the child process; a 401 from the MCP endpoint signals a signing problem') to move workflow_clarity toward 3.

Clearly signal the bundled script as a one-level-deep reference (e.g., 'The wrapper itself lives in references/asm-exec') so progressive disclosure navigation is explicit.

Tighten the SigV4 signing and prerequisites sections, moving deep credential-resolution detail to a reference if needed, to improve conciseness.

Dimension	Reasoning	Score
Conciseness	The body avoids explaining concepts Claude already knows (no 'what is a secret' filler) and stays on-skill, but the SigV4 signing, prerequisites, and 'How It Works' sections are detailed enough that they could be tightened; it is mostly efficient with some room to trim, matching anchor 2 rather than the fully-lean anchor 3.	2 / 3
Actionability	Provides multiple copy-paste-ready executable bash commands using asm-exec with concrete {{resolve:...}} references, a complete syntax table with defaults and examples, and specific common-pattern recipes, matching the anchor-3 fully-executable examples.	3 / 3
Workflow Clarity	The resolution flow is described as a numbered sequence (scan, resolve, substitute, run) and troubleshooting gives error-to-fix guidance, but the user-facing usage lacks explicit validation/checkpoint steps before or after running commands, so it sits at anchor 2 (steps present, checkpoints implicit) rather than the explicit-checkpoint anchor 3.	2 / 3
Progressive Disclosure	Sections are well-organized, but the bundled references/asm-exec script is only mentioned inline as 'a wrapper script (`asm-exec`)' without a clearly signaled navigation pointer (e.g., 'See references/asm-exec'), and a fair amount of detail lives inline in a ~170-line SKILL.md; per the guideline to score against the actual bundle structure, this matches anchor 2 (structure present but references not clearly signaled).	2 / 3
	Total	9 / 12 Passed

Description

72%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinct, and rich in natural trigger terms, but it omits an explicit "Use when" trigger clause, which caps its completeness. It is otherwise strong and appropriately concise.

Suggestions

Add an explicit 'Use when ...' trigger clause (e.g., 'Use when an agent needs to pass AWS Secrets Manager values to shell commands or tools') to raise completeness to 3.

Consider listing one or two more concrete actions (e.g., 'resolves {{resolve:...}} references at runtime') to move specificity from anchor 2 toward 3.

Keep the current third-person voice and natural keyword coverage, which already score well.

Dimension	Reasoning	Score
Specificity	Names a concrete mechanism ("dynamic references with asm-exec", "plaintext never enters the LLM context window") and a specific action ("Prevents AI agents from directly fetching secret values"), but lists only two actions rather than a comprehensive set, matching anchor 2; it is more concrete than the generic anchor-2 example but does not enumerate multiple distinct actions like the anchor-3 example.	2 / 3
Completeness	Clearly answers "what" (prevents fetching secret values, teaches dynamic references) but lacks an explicit "Use when..." or equivalent trigger clause; per the judging guidelines a missing "Use when" clause caps completeness at 2, so it does not reach anchor 3 despite a strong "what".	2 / 3
Trigger Term Quality	Includes natural terms users would say when handling secrets — "AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords" — giving good coverage of common variations, matching the anchor-3 example of broad natural-term coverage.	3 / 3
Distinctiveness Conflict Risk	Targets a clear niche (AWS Secrets Manager secret safety via asm-exec dynamic references) with distinct triggers unlikely to fire for unrelated skills, matching the anchor-3 example of a clear niche with distinct triggers.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-core/skills/aws-secrets-manager/SKILL.md
Commit: 222ce56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.