threat-modeling-with-aws-security-agent

Run an AWS Security Agent threat model review on spec/design documents. Use when the user asks to review a spec for security, run a threat model, check if a design introduces security risks, review requirements.md or design.md for security posture changes, or STRIDE analysis.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tightly written, highly actionable workflow skill with excellent executable commands and clean organization. The main gap is workflow clarity around failure handling: the polling loop covers success but never defines what to do when a threat-model job fails.

Suggestions

Add an explicit FAILED/ERROR branch to the polling step (e.g., on a non-COMPLETED terminal status, surface the failure reason and do not proceed to list-threats) to give the batch operation a proper validation feedback loop.

Collapse the `## Rules` restatements that duplicate the workflow ('no prior scan needed', 'poll every 2 minutes', 'use absolute paths') into the steps themselves, or reframe Rules as only the non-obvious constraints to remove redundancy.

Specify what to do when `setup-security-agent` is needed inline (step reference or one-line pointer) so the 'If missing, run the setup-security-agent workflow inline first' instruction is unambiguous.

Dimension	Reasoning	Score
Conciseness	The body is lean and command-driven, assuming Claude's competence with no concept explanations; the only minor tightening opportunity is the `## Rules` section restating items already in the workflow, but it serves as a useful quick-reference rather than padding.	3 / 3
Actionability	Provides fully executable AWS CLI commands (create-threat-model, start-threat-model-job, batch-get, list-threats) with every placeholder resolved via the resolution table — copy-paste ready after substitution.	3 / 3
Workflow Clarity	The 1–11 sequence is clear with a polling checkpoint and pagination handling, but for a batch/async job there is no explicit error-recovery branch (step 11 only addresses COMPLETED, not FAILED); the rubric caps batch-operation workflows missing a feedback loop at 2.	2 / 3
Progressive Disclosure	Self-contained with well-organized sections (Local state, Workflow, Findings presentation, Rules), no nested or multi-level references, and no bundle files needed — appropriate single-file structure.	3 / 3
	Total	11 / 12 Passed

Description

90%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit what-and-when structure and natural, distinctive triggers. Its only weakness is specificity: it states one main action rather than enumerating several concrete capabilities.

Dimension	Reasoning	Score
Specificity	Names the domain and a concrete action ("threat model review on spec/design documents") but does not list multiple distinct actions like the 3-anchor's 'extract, fill, merge'; a single primary action places it at the 'names domain and some actions' level.	2 / 3
Completeness	Explicitly answers what ("Run an AWS Security Agent threat model review on spec/design documents") and when (a full "Use when..." clause enumerating triggers), satisfying the 3-anchor's what-AND-when requirement.	3 / 3
Trigger Term Quality	Covers natural user phrasing well — "review a spec for security", "run a threat model", "check if a design introduces security risks", "review requirements.md or design.md", and "STRIDE analysis" are all terms a user would plausibly say.	3 / 3
Distinctiveness Conflict Risk	The AWS Security Agent + STRIDE + spec/design-documents framing is a clear niche with distinct triggers unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/threat-modeling-with-aws-security-agent/SKILL.md
Commit: 222ce56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.