aws-secrets-manager

Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords. Prevents AI agents from directly fetching secret values and teaches runtime dynamic references with asm-exec so plaintext never enters the LLM context window.

Quality

71%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/aws-core/skills/aws-secrets-manager/SKILL.md

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable examples and a clear rule/syntax/usage structure, backed by a real bundle script in references/. It is concise for a custom-tool skill and well-organized, with only minor gaps in explicit validation checkpoints and navigation pointers to the bundled implementation.

Dimension	Reasoning	Score
Conciseness	The body is efficient and assumes competence; explanations focus on the non-obvious custom tool (asm-exec, SigV4 signing, single-pass substitution) rather than concepts Claude already knows, with only minor trims possible in the How-It-Works prose.	4 / 5
Actionability	Copy-paste-ready executable examples cover the common cases (psql, curl, mysql, docker -e, config templating) alongside a concrete syntax table and specific troubleshooting commands like 'aws sts get-caller-identity'.	5 / 5
Workflow Clarity	A clear sequence is present (Rules -> Syntax -> Usage -> How It Works numbered steps) with troubleshooting feedback loops for error recovery, but there is no explicit pre-flight validation checkpoint before running a resolved command.	4 / 5
Progressive Disclosure	Well-organized into clearly signaled sections with the implementation correctly placed in references/asm-exec (one level deep), though the body never explicitly navigates the reader to that bundle file and inlines a fair amount of usage detail.	4 / 5
	Total	17 / 20 Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and trigger-rich, naming a concrete tool (asm-exec) and the core mechanism, but it omits an explicit 'Use when...' clause, capping completeness at 3. It is otherwise clearly scoped to AWS Secrets Manager with low conflict risk.

Suggestions

Add an explicit trigger clause, e.g. 'Use when an agent needs to pass AWS Secrets Manager values to shell commands or subprocesses without exposing plaintext.'

Expand the action list beyond 'prevents fetching' and 'teaches dynamic references' to concrete operations like injecting secrets into CLI args, env vars, and config templates.

Dimension	Reasoning	Score
Specificity	Names the domain (AWS Secrets Manager, credentials, API keys, tokens, passwords) and two concrete actions ('Prevents AI agents from directly fetching secret values' and 'teaches runtime dynamic references with asm-exec'), but coverage is limited to those two actions rather than a comprehensive list.	3 / 5
Completeness	It clearly states what the skill does (secret safety via dynamic references with asm-exec) but lacks any explicit 'Use when...' trigger clause, so per the guidelines completeness is capped at 3 with 'when' only weakly implied.	3 / 5
Trigger Term Quality	Strong natural keyword coverage including synonyms users actually say ('credentials, API keys, tokens, and passwords', 'secret management'), though it omits a few natural phrasings and has no file-extension-style triggers.	4 / 5
Distinctiveness Conflict Risk	The AWS Secrets Manager + asm-exec niche is clearly distinguishable with distinct triggers, though the broad 'secret management, credentials, API keys, tokens, and passwords' phrasing creates minor overlap risk with general secret-handling skills.	4 / 5
	Total	14 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-core/skills/aws-secrets-manager/SKILL.md
Commit: 21be518

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.