CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

managing-data-asset-access

Grants, requests, audits and removes access to data assets in an AWS data catalog (the Amazon SageMaker Catalog supported by Amazon DataZone) through catalog subscriptions over published listings. Covers requesting a subscription, approving or rejecting requests with a recorded decision, sharing a listing with a project, revoking one or many subscriptions, and confirming grant settlement. Triggers on: give another team access to a table, request access to a dataset, approve or reject an access request, share a listing with a project, who has access to this table, revoke access, bulk revoke, is the access actually gone, subscription grant status. Not for: IAM roles, policies or STS (use aws-iam), S3 bucket policies (use securing-s3-buckets), Clean Rooms permissions (use aws-cleanrooms), or writing catalog metadata, glossaries and forms, publishing listings, or retiring or deleting an asset that other teams are subscribed to and the order of operations that needs (use managing-data-catalog)

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong security-sensitive skill body: precise state-machine guidance, pervasive validation checkpoints, and a clean one-level-deep reference structure. Its only weakness is redundancy — the bulk-revoke confirmation rules and the MCP/local file-resolution guardrail repeat or over-explain material that could be consolidated or trimmed.

Suggestions

Consolidate the bulk-revocation confirmation rules, which currently appear in three sections ('Bulk work', the authorisation table, and the Security considerations table), into a single authoritative statement with references/bulk-revocation.md carrying the detail.

Trim or move the ~30-line MCP-vs-local file-resolution guardrail to a shorter paragraph or a reference, since it is runtime plumbing rather than access-management guidance.

For the two or three most common operations (approve a pending request, revoke one subscription), include a minimal inline command skeleton in the body so the common cases are actionable without first loading a reference.

DimensionReasoningScore

Conciseness

The body is dense and assumes Claude's competence — no padding explaining known AWS or data-catalog concepts — but the bulk-revocation confirmation rule is restated in three places (the 'Bulk work' section, the authorisation table, and the Security considerations table), and the ~30-line MCP-vs-local file-resolution guardrail is runtime plumbing that could be trimmed. This sits between the 3 and 5 anchors, noticeably above the midpoint: efficient with identifiable trims rather than unnecessary explanation.

4 / 5

Actionability

The body gives exact command flags ('--decision-comment', '--request-reason'), exact --query paths with terminal status values ('items[].status' → 'COMPLETED', per-asset 'GRANTED'/'REVOKED'), and copy-paste probe commands, but the executable runbooks for the common operations (approve, revoke, audit) are delegated to the references rather than given inline. This matches the 4 anchor (concrete commands with minor gaps) rather than 5, since the common cases are not copy-paste ready from the body alone.

4 / 5

Workflow Clarity

The sequence is explicit — probe identity and domain, resolve the acting project from identity, route via the table, act, then verify — and the destructive/batch validation bar is fully met: the confirm-the-plan-then-revoke checkpoint before bulk revocation, poll-to-settlement with per-asset verification, the three-outcome verdict ('A failed call is not a zero'), and re-showing the plan if the subscription set changed. Clear sequence with explicit validation, feedback loops, and checklists: the 5 anchor.

5 / 5

Progressive Disclosure

The body is a genuine overview with a router table mapping each user intent to one of seven one-level-deep reference files, all of which exist in the bundle, with no nested (2+ level) references. Cross-cutting rules that must be read before any chapter are appropriately in SKILL.md while procedures are split into references — clear overview, well-signaled references, easy navigation: the 5 anchor.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete lifecycle actions, natural trigger phrases with synonyms, explicit what/when, and explicit boundary routing to sibling skills. It is specific without buzzwords and concise despite its length, with every clause earning its place.

DimensionReasoningScore

Specificity

The description enumerates five concrete actions spanning the full lifecycle — 'requesting a subscription, approving or rejecting requests with a recorded decision, sharing a listing with a project, revoking one or many subscriptions, and confirming grant settlement' — plus the specific platform ('Amazon SageMaker Catalog supported by Amazon DataZone through catalog subscriptions over published listings'). This matches the comprehensive-coverage anchor, not the 4 anchor, because there are no minor gaps: grant, decide, share, audit, revoke and verify settlement are all named.

5 / 5

Completeness

It explicitly answers both questions: the 'what' is the first two sentences (the concrete operations), and the 'when' is an explicit 'Triggers on:' clause with concrete trigger phrases. This is the 5 anchor verbatim ('clearly and explicitly answers both what AND when with concrete trigger phrases').

5 / 5

Trigger Term Quality

The trigger list is composed of natural user phrasings with synonyms per operation: 'give another team access to a table', 'request access to a dataset', 'approve or reject an access request', 'who has access to this table', 'revoke access', 'bulk revoke', 'is the access actually gone'. Coverage is comprehensive across the natural variants users would actually say, matching the 5 anchor rather than the 4 anchor ('a few natural terms missing').

5 / 5

Distinctiveness Conflict Risk

The 'Not for:' clause disambiguates against every plausible neighbor by name — IAM/STS (aws-iam), S3 bucket policies (securing-s3-buckets), Clean Rooms (aws-cleanrooms), and catalog metadata/publishing/asset retirement (managing-data-catalog) — and the niche itself (catalog subscriptions over published listings) is distinct. Clear niche, minimal conflict risk: the 5 anchor.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

aws/agent-toolkit-for-aws

Path

plugins/aws-data-analytics/skills/managing-data-asset-access/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.