CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

aws-cloudformation-security

Provides AWS CloudFormation patterns for infrastructure security, secrets management, encryption, and secure data handling. Use when creating secure CloudFormation templates with AWS Secrets Manager, KMS encryption, secure parameters, IAM policies, VPC security groups, TLS/SSL certificates, and encrypted traffic configurations. Covers template structure, parameter best practices, cross-stack references, and defense-in-depth strategies.

60

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security/SKILL.md

The canonical home for this skill is giuseppe-trisciuoglio/developer-kit

SKILL.md
Quality
Evals
Security

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable, code-dense content that nonetheless far exceeds an overview's token budget by inlining full templates that duplicate the existing reference bundle. The main creation workflow also lacks explicit validation checkpoints despite CloudFormation deploys being risky.

Suggestions

Move the bulk of the inlined CloudFormation templates/examples into references/examples.md and reduce the SKILL.md Examples section to a few key snippets with pointers, so the body acts as an overview rather than duplicating the bundle.

Add validation checkpoints to the 'Instructions' workflow (e.g. run cfn-lint, create/review a change set, then deploy) with an explicit validate-fix-retry loop, since stack updates are risky operations.

Remove filler/duplication such as the base template's '# Resources will be defined here' placeholder, the repeated EXAMPLES.md pointers, and the trailing empty '## Additional Files' header.

DimensionReasoningScore

Conciseness

The style itself avoids explaining concepts Claude already knows, but the ~1674-line body inlines many full templates and duplicates content already in references/examples.md, plus filler like a base template stating '# Resources will be defined here' and a trailing empty '## Additional Files' header, so it could be tightened substantially.

3 / 5

Actionability

Provides abundant concrete, copy-paste-ready CloudFormation YAML plus bash and Python (e.g. the drift-detection handler and change-set script), but many snippets reference undefined parameters/resources (OrganizationId, CodeBucket, VPCId, DataBucket.Arn), leaving minor execution gaps.

4 / 5

Workflow Clarity

The core 'Instructions' lists an 8-step sequence but has no validation checkpoints or feedback loops (no cfn-lint, change-set review, or pre-deploy validation step); the later stack-management section covers change sets/drift/rollback, but the primary workflow stays checkpoint-less, and risky stack deploys cap this at 3.

3 / 5

Progressive Disclosure

References to references/examples.md and references/reference.md are clearly signaled and one level deep, and section structure is good, but the vast majority of templates/examples are inlined in SKILL.md despite the bundle files already holding that detail, which is the over-inlining anti-pattern the rubric penalizes.

3 / 5

Total

13

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted description that clearly states both what the skill provides and when to use it, with strong domain-specific trigger keywords and synonyms. It is held back only by domain-naming verbs rather than crisp action verbs and a few missing common phrasings.

DimensionReasoningScore

Specificity

Lists several concrete capability areas ('infrastructure security, secrets management, encryption, and secure data handling', 'template structure, parameter best practices, cross-stack references, and defense-in-depth strategies'), but the verbs 'Provides patterns for' / 'Covers' name domains more than discrete actions like the score-5 anchor's 'Extract...fill...merge...convert'.

4 / 5

Completeness

Explicitly answers both what ('Provides AWS CloudFormation patterns for...') and when ('Use when creating secure CloudFormation templates with...') with concrete trigger phrases, matching the score-5 anchor.

5 / 5

Trigger Term Quality

Strong natural keyword coverage with synonyms ('secrets management' / 'Secrets Manager', 'encryption' / 'KMS encryption', 'TLS/SSL certificates'), but common phrasings like 'infrastructure as code', 'IaC', 'CloudFormation stack', or '.yaml' templates are absent, so it is not fully comprehensive.

4 / 5

Distinctiveness Conflict Risk

CloudFormation-specific framing and concrete triggers make it mostly distinct with minimal conflict risk, but broad terms like 'infrastructure security', 'secrets management', and 'encryption' could overlap with a general AWS-security or generic IaC skill, keeping it just below a 5.

4 / 5

Total

17

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (1680 lines); consider splitting into references/ and linking

Warning

allowed_tools_field

'allowed-tools' contains unusual tool name(s)

Warning

Total

14

/

16

Passed

Repository

fernandezbaptiste/developer-kit

Path

plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-security/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.