setup-security-agent

Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket. Use when the user asks to "set up security agent", "configure security scanner", "is security agent configured", or on first-time use before any scan or pentest.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable runbook with executable commands, complete policies, and a well-sequenced idempotent workflow including validation checkpoints and troubleshooting. Its only weakness is structural: everything lives inline in one file with no progressive disclosure into reference materials.

Suggestions

Move the IAM trust/permission policy JSON and the S3 lifecycle/public-access-block snippets into a references/ file (e.g. POLICIES.md) and link to it from the workflow to add one level of progressive disclosure.

Consider extracting the Troubleshooting section into a separate reference file linked from the main body, keeping SKILL.md as a tighter overview + workflow.

Dimension	Reasoning	Score
Conciseness	Lean and operational: executable AWS CLI commands and complete JSON policies with no padding explaining what AWS/IAM/S3 are; the little prose present (e.g. 'Why minimal config') is decision rationale that earns its place rather than concept exposition.	3 / 3
Actionability	Fully executable, copy-paste-ready commands with concrete resource names and complete trust/permission/lifecycle JSON documents, leaving no key detail to inference.	3 / 3
Workflow Clarity	A clearly sequenced 9-step workflow with explicit validation checkpoints (probe-then-create for the role, bucket, and agent space) and idempotency fallbacks (EntityAlreadyExists -> update-assume-role-policy), plus a troubleshooting section for error recovery.	3 / 3
Progressive Disclosure	Well-organized into clear sections, but it is a single ~180-line monolithic file with no bundle files and no one-level-deep references to split out the IAM policy documents or troubleshooting material, so content that could be separate stays inline.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, third-person description that states concrete provisioning actions and pairs them with explicit natural-language triggers and a first-time-use condition. It clearly answers both what the skill does and when to invoke it, with low conflict risk against sibling skills.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions — 'provision or reuse an agent space, IAM service role, and S3 bucket' — matching the anchor that lists several specific concrete actions rather than vague language.	3 / 3
Completeness	Explicitly answers both what ('Configure AWS Security Agent ... provision or reuse ...') and when ('Use when the user asks ... or on first-time use before any scan or pentest'), with an explicit 'Use when' trigger clause.	3 / 3
Trigger Term Quality	Includes natural phrases a user would actually say — 'set up security agent', 'configure security scanner', 'is security agent configured' — giving good coverage of how the need arises in conversation.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (AWS Security Agent setup) with distinct triggers that separate it from the scan and pentest skills it references, making mis-triggering unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/setup-security-agent/SKILL.md
Commit: 222ce56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.