setup-security-agent

Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket. Use when the user asks to "set up security agent", "configure security scanner", "is security agent configured", or on first-time use before any scan or pentest.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced setup skill with copy-paste AWS commands, idempotency handling, and clear safety rules. Its main gaps are minor over-explanation of adjacent skills' state and the absence of a final end-to-end verification step.

Suggestions

Add a final verification step that confirms the linked setup works end-to-end (e.g., a dry-run assume-role or listing the registered awsResources) before declaring "Setup complete."

Trim or move the scans.json/pentests.json descriptions, since this skill only populates config.json and .gitignore — those sibling-state details belong with the scan/pentest skills.

Consider extracting the trust/permissions/lifecycle JSON blobs into a references/ file if the skill grows, to keep the workflow steps scannable.

Dimension	Reasoning	Score
Conciseness	The body is lean with concrete aws CLI commands and inline JSON policies, but includes minor asides such as the "Why minimal config" rationale and shared-state files (scans.json, pentests.json) this skill does not create, keeping it just below a 5.	4 / 5
Actionability	Every step provides fully executable, copy-paste-ready aws CLI commands with real flags plus complete trust/permissions/lifecycle JSON, and even covers us-east-1 vs other-region variants, matching the anchor-5 example.	5 / 5
Workflow Clarity	A clear nine-step sequence with probing and idempotency feedback loops (NoSuchEntity/EntityAlreadyExists fallback, missing-resource merge) plus a Rules checklist; not a 5 because there is no final end-to-end verification that the linked setup actually works.	4 / 5
Progressive Disclosure	Well-organized into Local state convention, Derived values, Workflow, Rules, and Troubleshooting with all content appropriately inline for a one-shot setup procedure and no nested references; not a 5 because at ~175 lines it exceeds the simple-skill (<50 line) exception and nothing is split out.	4 / 5
	Total	17 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-targeted description that explicitly answers both what and when with concrete quoted trigger phrases and a distinct AWS-specific niche. Minor room to broaden trigger synonyms and verbs, but it lands near the top of the scale.

Dimension	Reasoning	Score
Specificity	"provision or reuse an agent space, IAM service role, and S3 bucket" lists several concrete actions across three named resources, sitting between anchor 4 (several specific actions, minor gaps) and anchor 5 (comprehensive); it is not a 5 because the verbs are limited to provision/reuse.	4 / 5
Completeness	It explicitly states what it does ("Configure AWS Security Agent ... provision or reuse ...") and when to use it ("Use when the user asks ... or on first-time use before any scan or pentest") with concrete trigger phrases, matching the anchor-5 example exactly.	5 / 5
Trigger Term Quality	Three quoted natural phrases ("set up security agent", "configure security scanner", "is security agent configured") plus a scenario trigger give good keyword coverage with synonyms (security agent / security scanner); not a 5 because a few natural variants like "install" or "enable" are absent.	4 / 5
Distinctiveness Conflict Risk	"Configure AWS Security Agent" is a clear niche with distinct triggers, and the body explicitly states scans and pentests live in separate skills, giving minimal conflict risk.	5 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/setup-security-agent/SKILL.md
Commit: 21be518

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.