creating-secrets-using-best-practices

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-structured with good progressive disclosure via a single real reference file. Weakness lies in workflow clarity and actionability: the main creation procedure and its validation checkpoints live entirely in the reference rather than being surfaced inline.

Suggestions

Surface a brief inline summary of the creation workflow steps and at least one validation checkpoint (e.g., verify the secret is decryptable by the intended principal) so the body is actionable without opening the reference.

Add a short feedback loop for the destructive aspects of secret lifecycle (recovery window / deletion) — e.g., confirm recovery_window before deletion and verify via describe-secret afterward.

Include one inline executable command example (e.g., the aws secretsmanager create-secret or kms create-key call) so the most common action is copy-paste ready.

Dimension	Reasoning	Score
Conciseness	The body is lean with no padding or re-explanation of concepts Claude already knows; every section earns its place and assumes Claude's competence.	5 / 5
Actionability	Troubleshooting gives concrete checks (verify kms:CreateKey/kms:PutKeyPolicy, review CloudWatch logs), but the core creation procedure is delegated to the reference file rather than providing inline executable commands.	4 / 5
Workflow Clarity	Creation steps are present only as a pointer to the reference ('follow the procedure exactly'), and explicit validation checkpoints for secret creation are not surfaced in the body itself.	3 / 5
Progressive Disclosure	SKILL.md is a clear overview with a well-signaled, one-level-deep reference (references/create-secrets-using-best-practices.md) that exists and is appropriately split from the overview.	5 / 5
	Total	17 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it concisely states concrete capabilities and provides an explicit 'use when' trigger, covering both what and when clearly. The only gap is modest coverage of natural synonym triggers.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management' — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Explicitly answers both 'what' (creates/manages secrets with KMS, rotation, IAM, CloudTrail, lifecycle) and 'when' ('Always use this skill when creating secrets') with concrete trigger phrasing.	5 / 5
Trigger Term Quality	Includes natural triggers like 'creating secrets', 'secrets', and 'AWS Secrets Manager', but omits common synonyms users might say such as 'credentials', 'passwords', or 'API keys'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche — production-grade AWS Secrets Manager creation — with distinct triggers and minimal overlap risk against unrelated skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aws/agent-toolkit-for-aws
Path: skills/specialized-skills/security-and-identity-skills/creating-secrets-using-best-practices/SKILL.md
Commit: d6ad2e4

Reviewed: about 3 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.