aws-penetration-testing
Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
78
73%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Critical
Do not install without reviewing
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/antigravity-aws-penetration-testing/SKILL.mdQuality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong description with excellent specificity and domain-relevant trigger terms that security professionals would naturally use. Its main weakness is the lack of an explicit 'Use when...' clause, which would help Claude know precisely when to select this skill over others. Adding trigger guidance would elevate this from a good to an excellent description.
Suggestions
Add a 'Use when...' clause such as 'Use when the user asks about AWS penetration testing, cloud security assessments, red teaming AWS infrastructure, or exploiting AWS services like IAM, S3, or Lambda.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques. These are well-defined, actionable capabilities. | 3 / 3 |
Completeness | The 'what' is clearly answered with specific techniques and actions. However, there is no explicit 'Use when...' clause or equivalent trigger guidance telling Claude when to select this skill, which caps this dimension at 2 per the rubric guidelines. | 2 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'penetration testing', 'AWS', 'IAM', 'privilege escalation', 'SSRF', 'S3 bucket', 'Lambda', 'red team'. These cover the domain well and match how security professionals naturally describe these tasks. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche: AWS cloud penetration testing and red team operations. The specific combination of AWS services (IAM, S3, Lambda) and attack techniques (SSRF to metadata, privilege escalation) makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
64%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a comprehensive, highly actionable AWS penetration testing skill with concrete, executable commands throughout. Its main weaknesses are the length (could benefit from splitting detailed technique sections into referenced files) and the lack of validation checkpoints in workflows involving destructive or high-risk operations. The content is well-structured with tables and clear sections but could be more concise by removing redundant framing.
Suggestions
Add explicit validation/verification steps within the workflow, especially before destructive operations like disabling CloudTrail or modifying Lambda code (e.g., 'Verify current trail status before modification', 'Confirm function name and current code before overwriting').
Split detailed technique sections (S3 exploitation, EC2 exploitation, privilege escalation) into separate referenced files to reduce the main skill's token footprint and improve progressive disclosure.
Remove the redundant 'When to Use' section and trim the Purpose section since it duplicates the description; also remove the Prerequisites bullet about 'Understanding of AWS IAM model' which is not actionable.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary verbosity—the Purpose section repeats the description, the 'When to Use' section is a meaningless tautology, and some sections like the tool table and prerequisites list things Claude would know how to find. However, most content is command-focused and reasonably efficient. | 2 / 3 |
Actionability | The skill provides fully executable bash commands and Python code throughout, with specific CLI syntax, real flag names, and concrete examples. Commands are copy-paste ready with clear placeholders for user-specific values. | 3 / 3 |
Workflow Clarity | The core workflow has numbered steps with clear sequencing (enumeration → IAM → SSRF → escalation), but there are no validation checkpoints or feedback loops. For destructive operations like disabling CloudTrail or modifying Lambda code, there's no verify-before-proceeding pattern. The constraints section mentions documentation but doesn't integrate verification into the workflow itself. | 2 / 3 |
Progressive Disclosure | The skill references an advanced file (references/advanced-aws-pentesting.md) for deeper topics, which is good one-level-deep disclosure. However, the main file is quite long (~300+ lines) with substantial inline content that could be split into separate reference files (e.g., S3 exploitation, EC2 exploitation, privilege escalation techniques). No bundle files are provided to verify the referenced path exists. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- boisenoise/skills-collections
- Commit
431bfad
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.