hf-cloud-sagemaker-iam-preflight

Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

92%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured, highly executable preflight guide: a three-step order of operations with real validation checkpoints, a deliberate failure path, and policy details correctly split into existing reference files. It is only marginally trimmable in its rationale paragraphs.

Dimension	Reasoning	Score
Conciseness	The body is dense and operational with no filler explaining things Claude already knows, but rationale paragraphs like 'Why rank by last-used' and the multi-sentence Windows/WSL caveat are explanatory rather than instructional and could be trimmed slightly — matching anchor 4's 'minor instances of over-explanation'.	4 / 5
Actionability	Every path is copy-paste ready: check_role.py with and without a role argument, create_role.py with role-name and bucket args and documented behavior when the bucket is omitted, a concrete admin-request message template for the SSO-blocked case, and executable native AWS CLI fallback commands.	5 / 5
Workflow Clarity	A clear discover-validate-create-only-if-needed sequence with explicit validation checkpoints: exit 0/ARN-to-stdout on success, stderr reason on failure, 'Don't try to silently fix a broken role — surface the problem', and a hard stop with specific instructions when SSO blocks creation. No destructive or batch operation applies, so the workflow-cap rule is not triggered.	5 / 5
Progressive Disclosure	The workflow overview stays in SKILL.md while the canonical trust policy and full minimum-permissions policy live in clearly signaled, one-level-deep references (references/trust-policy.json, references/minimum-permissions.json) that exist in the bundle and match the body's descriptions; helper logic is properly delegated to scripts/check_role.py and scripts/create_role.py.	5 / 5
	Total	19 / 20 Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states what the skill does and gives layered, explicit when-to-use triggers in third person with concrete AWS terms. Its only weaknesses are that the capability list is effectively one guarded action rather than several, and one trigger clause (AccessDenied + IAM action) is not scoped to SageMaker.

Dimension	Reasoning	Score
Specificity	Concrete actions like 'Ensure a usable SageMaker execution role exists', 'always check for existing roles first', and specific triggers (endpoint, model, training job, role ARN, iam:CreateRole) go beyond anchor 3's 1-2 actions, but the skill is essentially one core action (ensure a usable role) rather than the multiple distinct actions of anchor 5.	4 / 5
Completeness	Explicitly answers both: what ('Ensure a usable SageMaker execution role exists before deploying or training') and when ('Use this skill whenever about to create a SageMaker endpoint... especially when the user has not provided a role ARN explicitly, when scripts are about to call iam:CreateRole, or when an AccessDenied error mentions an IAM action').	5 / 5
Trigger Term Quality	Natural phrases a user would say are comprehensively covered: 'deploying or training', 'SageMaker endpoint, model, training job', 'role ARN', 'AccessDenied error', and 'iam:CreateRole' — file extensions are not applicable to this domain.	5 / 5
Distinctiveness Conflict Risk	The SageMaker execution-role niche is clearly distinct, but 'when an AccessDenied error mentions an IAM action' is not SageMaker-qualified and could fire for unrelated AWS IAM errors, giving minor overlap risk with closely related AWS/IAM skills.	4 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: huggingface/skills
Path: skills/hf-cloud-sagemaker-iam-preflight/SKILL.md
Commit: ca0325b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.