Content
92%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A strong consultant-grade skill body: concrete commands, explicit validation feedback loops, and exemplary progressive disclosure into a real one-level-deep reference bundle. The only notable issue is redundancy between the Authorization and Boundaries sections and some trimmable flavor text, which keeps conciseness at 4.
Suggestions
Merge the Authorization section into Boundaries (or vice versa) — both state the audit-scope rule and the never-exercise-escalation-paths rule, so one of the two can be deleted outright.
Trim the editorializing in "Common audit findings" (e.g., "nobody knows what they all do; nobody dares delete one") down to the finding statement plus the identifying signal.
Consider moving the long worked examples inside the verdict table's Examples cells to references/verification.md, keeping just the one-line rule for each verdict inline.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The body is dense with expert judgment Claude does not already have — "Service accounts with iam.serviceAccountTokenCreator on themselves = self-impersonation", "Principal: { AWS: "*" } is open to the world" — with no explanations of basic concepts. It falls short of 5 because the Authorization section and the Boundaries section restate the same rules (authorization scope, never exercising escalation paths), and "Common audit findings" carries flavor text ("nobody dares delete one") that could be trimmed. | 4 / 5 |
Actionability | Guidance is fully executable throughout: exact CLI commands ("aws accessanalyzer list-findings", "gcloud asset analyze-iam-policy"), a runnable validator ("node references/validate-findings.mjs findings.json"), concrete evidence filenames, a fingerprint format with worked examples, and a copy-paste report template. This matches the copy-paste-ready anchor with specific examples covering the common cases. | 5 / 5 |
Workflow Clarity | The three modes are explicitly selected ("pick the one that matches the engagement"), the findings pipeline is a numbered 7-step "Verify, then record" sequence with an explicit refutation checkpoint and a validate-fix-revalidate feedback loop ("fix until it passes"), and the migration playbook is a 7-step sequence with per-wave rollback procedures. All operations are read-only by design and validation is present anyway, so no cap applies. | 5 / 5 |
Progressive Disclosure | The SKILL.md is a well-structured overview, and the heavy detail is correctly offloaded one level deep with clearly signaled links to real files that all exist: [references/ad-tier0-paths.md], [references/findings-format.md], [references/verification.md], [references/severity-calibration.md], plus the validator/SARIF scripts. Core decision rules (verdict table, fingerprint classes) stay inline where they are needed on every audit; this fits the clear-overview anchor rather than the 4 anchor's "minor organization gaps". | 5 / 5 |
Total | 19 / 20 Passed |