CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

bedrock-agentcore-policy

Amazon Bedrock AgentCore Policy for defining agent boundaries using natural language and Cedar. Deterministic policy enforcement at the Gateway level. Use when setting agent guardrails, access control, tool permissions, or compliance rules.

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.claude/skills/bedrock-agentcore-policy/SKILL.md

The canonical home for this skill is bedrock-agentcore-policy in fernandezbaptiste/Skrillz

SKILL.md
Quality
Evals
Security

Quality

Content

60%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A code-dense, actionable operations manual with a clear operation sequence and real validation checkpoints, but it fails at its own progressive-disclosure design: all three referenced files are missing from the bundle and their content is inlined instead, inflating the body and duplicating patterns. Tightening the duplication and shipping the reference files would raise most dimensions.

Suggestions

Create the referenced bundle files (references/cedar-syntax.md, references/policy-patterns.md, references/troubleshooting.md) or remove the References section — as delivered, all three paths are dangling and unreachable.

Move the six-pattern library (Operation 3) and the Cedar Quick Reference into references/policy-patterns.md and references/cedar-syntax.md, cutting the SKILL.md body to an overview plus the core operations and removing the near-verbatim repetition of the role-tag pattern.

Drop or relocate time-sensitive claims ('validated by AWS December 2025', the Quality Targets latency figures) into a versioned/deprecated section, and make the Operation 5 test-scenario code runnable by defining or removing the simulate_policy placeholder.

DimensionReasoningScore

Conciseness

The body is mostly dense, operational code rather than concept explanations, but it could be tightened: the role-tag pattern ('principal.hasTag("role") && principal.getTag("role") == ...') appears nearly verbatim in Operations 1, 2, 3 (Patterns 1 and 6), and Best Practices; the 'Cedar Quick Reference' section duplicates syntax already shown in the operations; and time-sensitive claims like 'validated by AWS December 2025' and product 'Quality Targets' (< 5 seconds, < 10ms) pad the doc outside any deprecated/old-patterns section. This fits 'mostly efficient but includes some unnecessary explanation or could be tightened' rather than 4, where trimming would be minor.

3 / 5

Actionability

Mostly executable, copy-paste-able guidance: complete boto3 workflows for start_policy_generation with waiters, create_policy with full Cedar content, create_policy_engine/update_policy_engine, and invoke_agent_runtime testing. Gaps keep it below 5: the test-scenarios function calls an undefined simulate_policy(case) (pseudocode, not runnable), and the create_policy snippet in Best Practices uses a '...' placeholder. It is well above 3 since the primary paths are concrete and complete rather than pseudocode.

4 / 5

Workflow Clarity

The five operations form a clear, logically ordered pipeline (author/generate → review Cedar → create engine → attach policies → test and debug) with explicit checkpoints: waiters for PolicyGenerationCompleted and PolicyEngineActive, a validation-results check in Operations 1 and 5, an enforcement test, and CloudWatch PolicyDecision debugging. Not 5 because there is no explicit error-recovery loop — the common-issues list (overly permissive, unsatisfiable conditions, schema mismatch) is not tied to corrective next steps, and the test-scenario harness is a sketch. Validation is present, so the destructive/batch cap at 3 does not apply.

4 / 5

Progressive Disclosure

The body cites 'references/cedar-syntax.md', 'references/policy-patterns.md', and 'references/troubleshooting.md', but the bundle contains no references/ directory at all — every reference path is dead. Meanwhile ~150 lines of content that clearly belongs in those files (the six-pattern library in Operation 3 and the Cedar Quick Reference) are inlined in a ~590-line SKILL.md. This matches 'content that clearly belongs in separate files is inlined' and is noticeably below the midpoint: the split was designed (the files are even named) but never delivered, so navigation to the referenced material fails entirely.

2 / 5

Total

13

/

20

Passed

Description

78%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: explicit what and when with concrete trigger phrases, distinctive technical markers, and third-person voice. The main gaps are modest action coverage in the what-statement and a few missing natural synonyms (policy, Cedar, RBAC) in the trigger list.

DimensionReasoningScore

Specificity

It names the domain and mechanism concretely — 'defining agent boundaries using natural language and Cedar' and 'Deterministic policy enforcement at the Gateway level' — which is 1-2 concrete actions, but coverage is not comprehensive: it omits authoring/generating policies, validating them, or attaching them to a Gateway, the skill's actual operations. Fits 'names domain and 1-2 concrete actions, but not comprehensive' rather than 4's 'several specific actions'.

3 / 5

Completeness

It explicitly answers both questions: what — 'defining agent boundaries using natural language and Cedar. Deterministic policy enforcement at the Gateway level' — and when, via a concrete 'Use when setting agent guardrails, access control, tool permissions, or compliance rules' trigger clause. This matches the anchor 'clearly and explicitly answers both what AND when with concrete trigger phrases'; the when is specific, not merely present, so 4 does not fit.

5 / 5

Trigger Term Quality

'Use when setting agent guardrails, access control, tool permissions, or compliance rules' provides four natural phrases users would plausibly say. A few natural terms are missing — notably 'policy', 'Cedar', 'RBAC'/'role-based', and 'restrict what my agent can do' — which keeps it at 'good keyword coverage; a few natural terms missing' rather than the comprehensive synonym/extension coverage of a 5.

4 / 5

Distinctiveness Conflict Risk

The niche is clear (Bedrock AgentCore + Cedar + Gateway enforcement) with distinct technical markers, but 'agent guardrails' as a trigger overlaps with a Bedrock Guardrails skill — the skill body itself redirects content filtering there, confirming the overlap — and sibling bedrock-agentcore-* skills share the platform prefix. Fits 'mostly distinct; minor overlap risk with closely related skills'.

4 / 5

Total

16

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (595 lines); consider splitting into references/ and linking

Warning

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

referenced_paths_exist

Referenced path issues: 3 missing

Warning

Total

13

/

16

Passed

Repository

fernandezbaptiste/Skrillz

Path

.claude/skills/bedrock-agentcore-policy/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.