threat-modeling-with-aws-security-agent

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/aws-agents-for-devsecops/skills/threat-modeling-with-aws-security-agent/SKILL.md

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable operational workflow: every step has concrete commands and placeholders are systematically resolved. The main weaknesses are missing failure-path handling in the polling loop, an underspecified scans.json persistence step, and some redundancy between the Rules section and the workflow body.

Suggestions

Add explicit handling for FAILED or errored threat-model job states in the polling step (step 10-11), e.g., fetch error details and report them to the user.

Specify the exact scans.json record format in step 8 (required fields alongside scan_type: "THREAT_MODEL", e.g., scanId, threatModelId, threatJobId, timestamp).

Deduplicate the Rules section against the workflow body — 'poll every 2 minutes', 'no prior scan needed', and 'absolute paths' each appear twice.

Dimension	Reasoning	Score
Conciseness	Command-first, lean steps with no explanations of known concepts, but the Rules section duplicates in-body guidance ("Poll every 2 minutes, not faster", "no prior scan needed", "Use absolute paths"), which could be trimmed.	4 / 5
Actionability	Concrete executable zip/aws/s3 commands backed by a placeholder-resolution table; minor gaps remain — step 8 "Persist to scans.json" specifies no format or fields, and the --scope-docs quoting in step 6 is fragile.	4 / 5
Workflow Clarity	Eleven clearly sequenced steps with ID capture, a bounded polling loop, and pagination handling, but the poll loop defines no FAILED or error-path handling and uploads are never verified — minor validation gaps consistent with anchor 4 rather than 5.	4 / 5
Progressive Disclosure	A single-file skill (~120 lines) with well-organized sections (Local state, Workflow, Findings presentation, Rules) and no external references needed; it exceeds the under-50-line simple-skill exception, so good-but-not-ideal structure earns anchor 4.	4 / 5
	Total	16 / 20 Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with an explicit 'Use when' clause covering multiple natural trigger phrases and concrete file names. Its main limitation is a thin 'what': it names a single action rather than enumerating the capability set.

Dimension	Reasoning	Score
Specificity	Names the tool ("AWS Security Agent") and target ("spec/design documents") but states only one concrete action — "Run a threat model review" — without enumerating sub-capabilities, matching the '1-2 concrete actions, not comprehensive' anchor.	3 / 5
Completeness	Explicitly answers both: a clear "what" ("Run an AWS Security Agent threat model review on spec/design documents") and a concrete "Use when" clause with five distinct trigger phrases.	5 / 5
Trigger Term Quality	Good natural-phrase coverage: "review a spec for security", "run a threat model", "STRIDE analysis", plus concrete file names (requirements.md, design.md); a few common synonyms (e.g., "attack surface", "security design review") are missing, so it does not reach comprehensive anchor 5.	4 / 5
Distinctiveness Conflict Risk	A clear niche (AWS Security Agent threat modeling on spec documents) with distinctive triggers including file names, but "review a spec for security" could overlap with a generic security-review skill, giving minor overlap risk rather than minimal.	4 / 5
	Total	16 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/threat-modeling-with-aws-security-agent/SKILL.md
Commit: b8171ad

Reviewed: 5 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.