aws-penetration-testing
Provide comprehensive techniques for penetration testing AWS cloud environments. Covers IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques for red team operations.
81
77%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Critical
Do not install without reviewing
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/antigravity-aws-penetration-testing/SKILL.mdQuality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong description with excellent specificity and domain-relevant trigger terms that security professionals would naturally use. Its main weakness is the lack of an explicit 'Use when...' clause, which would help Claude know precisely when to select this skill. Adding trigger guidance would elevate this from good to excellent.
Suggestions
Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about AWS penetration testing, cloud security assessments, red teaming AWS infrastructure, or exploiting AWS services like IAM, S3, or Lambda.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: IAM enumeration, privilege escalation, SSRF to metadata endpoint, S3 bucket exploitation, Lambda code extraction, and persistence techniques. These are well-defined, actionable capabilities. | 3 / 3 |
Completeness | The 'what' is clearly answered with specific techniques, but there is no explicit 'Use when...' clause or equivalent trigger guidance. The 'when' is only implied by the domain context. Per rubric guidelines, missing 'Use when...' caps completeness at 2. | 2 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'penetration testing', 'AWS', 'IAM', 'privilege escalation', 'SSRF', 'S3 bucket', 'Lambda', 'red team'. These cover the domain well and match how security professionals would phrase requests. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche: AWS-specific penetration testing and red team operations. The combination of AWS cloud services (IAM, S3, Lambda) with offensive security techniques makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
72%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a comprehensive and highly actionable AWS penetration testing skill with concrete, executable commands throughout. Its main weaknesses are the lack of validation checkpoints in multi-step exploitation workflows (especially for destructive operations like CloudTrail deletion or privilege escalation) and some unnecessary verbosity in explanatory text. The progressive disclosure and overall organization are strong, with appropriate use of tables and a clear reference to advanced material.
Suggestions
Add explicit validation/verification steps after critical operations (e.g., after attaching admin policy, verify with `aws iam list-attached-user-policies`; after Lambda code update, invoke and confirm execution)
Remove explanatory sentences Claude already knows, such as 'Systems Manager allows command execution on EC2 instances' and the Purpose section that duplicates the description
Add feedback loops for risky operations: e.g., after disabling CloudTrail, verify with `aws cloudtrail get-trail-status`; include rollback commands for cleanup
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is fairly comprehensive but includes some unnecessary verbosity like the 'Purpose' section restating the description, the 'When to Use' boilerplate at the end, and some explanatory text that Claude would already know (e.g., 'Systems Manager allows command execution on EC2 instances'). The tool table installation column and some section headers could be tightened. | 2 / 3 |
Actionability | The skill provides fully executable, copy-paste ready commands throughout. Every technique includes concrete bash commands or Python code with specific flags, arguments, and expected outputs (e.g., the metadata SSRF response JSON, the Lambda privilege escalation code). The commands are real and specific, not pseudocode. | 3 / 3 |
Workflow Clarity | The core workflow has numbered steps (1-3) but lacks validation checkpoints between steps. For destructive/risky operations like disabling CloudTrail, modifying Lambda code, or attaching admin policies, there are no verification steps or feedback loops. The 'Covering Tracks' section describes disabling security controls without explicit validation that the operation succeeded or rollback guidance. | 2 / 3 |
Progressive Disclosure | The skill is well-structured with clear sections, a quick reference table for common commands, and appropriately defers advanced topics (Lambda/API Gateway, Secrets Manager, container security, etc.) to a single referenced file. The content is organized logically from enumeration through exploitation to cleanup, with one-level-deep references. | 3 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- boisenoise/skills-collections
- Commit
353f6a8
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.