hf-cloud-sagemaker-iam-preflight

Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with executable commands, a clearly sequenced validate-discover-create workflow, and properly externalized reference files. Minor conciseness trims in the Windows caveat and an explicit post-create verification step would push it to full marks.

Suggestions

Tighten the Windows/WSL/Git Bash caveat, which currently restates the bash-shim point across multiple sections; consolidate it into one concise warning.

Add an explicit post-create verification step (e.g., re-run check_role.py on the newly created role) to close the workflow_clarity validation loop.

Consider moving the multi-command native AWS CLI fallback into a short reference or trimming it, since it duplicates logic already captured by the bundled scripts.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and focused on non-obvious operational gotchas (SSO/Windows AWS context) that Claude would not already know, but the Windows/WSL/Git Bash caveat is repeated and somewhat verbose, keeping it just below the lean-throughout anchor 5.	4 / 5
Actionability	Provides copy-paste-ready commands for every common case ('python3 scripts/check_role.py "<role-name-or-arn>"', 'python3 scripts/create_role.py "<role-name>" "<model-bucket>"') plus a complete native AWS CLI fallback, matching the fully-executable anchor.	5 / 5
Workflow Clarity	Clear three-step sequence (validate provided role -> discover existing -> create only if empty) with explicit validation checkpoints (exit codes, trust-policy validation, 'Don't try to silently fix a broken role - surface the problem'), but lacks an explicit post-create re-verification step, so it sits at anchor 4 rather than 5.	4 / 5
Progressive Disclosure	The body is an overview that clearly signals one-level-deep references to real bundle files ('see references/trust-policy.json for the canonical form', 'references/minimum-permissions.json covers what SageMaker actually needs') and externalizes logic into scripts/check_role.py and scripts/create_role.py, fitting the clear-overview anchor.	5 / 5
	Total	18 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what the skill does and gives multiple concrete, natural trigger conditions including the AccessDenied error path. It is tightly scoped to SageMaker IAM preflight with negligible conflict risk.

Dimension	Reasoning	Score
Specificity	Names the SageMaker execution-role domain and several concrete actions ('Ensure a usable SageMaker execution role exists', 'check for existing roles first', 'prevents...trying to create IAM resources'), but the actions lean toward when-to-use framing rather than a comprehensive capability list, so it stops short of a 5.	4 / 5
Completeness	Explicitly answers both what ('Ensure a usable SageMaker execution role exists before deploying or training') and when ('Use this skill whenever about to create...Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call iam:CreateRole, or when an AccessDenied error mentions an IAM action') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Covers natural user terms and synonyms ('SageMaker endpoint, model, training job', 'role ARN', 'deploying or training') plus the error-message trigger ('AccessDenied error mentions an IAM action'), matching the comprehensive-coverage anchor.	5 / 5
Distinctiveness Conflict Risk	Tightly scoped to SageMaker IAM preflight with distinct triggers (execution role, iam:CreateRole, AccessDenied on IAM) and minimal overlap with other skills, fitting the clear-niche anchor.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: huggingface/skills
Path: skills/hf-cloud-sagemaker-iam-preflight/SKILL.md
Commit: 97862b0

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.