azure-rbac
Helps users find the right Azure RBAC role for an identity with least privilege access, then generate CLI commands and Bicep code to assign it. Also provides guidance on permissions required to grant roles. WHEN: what role should I assign, least privilege role, RBAC role for, role to read blobs, role for managed identity, custom role definition, assign role to identity, what role do I need to grant access, permissions to assign roles.
83
78%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./.github/skills/azure-rbac/SKILL.mdQuality
Discovery
100%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong skill description that clearly articulates specific capabilities (finding RBAC roles, generating CLI/Bicep code, permissions guidance) and provides an explicit WHEN clause with a comprehensive set of natural trigger phrases. The description is well-scoped to Azure RBAC, making it highly distinctive and unlikely to conflict with other skills.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: finding the right Azure RBAC role, generating CLI commands, generating Bicep code for role assignment, and providing guidance on permissions required to grant roles. | 3 / 3 |
Completeness | Clearly answers both 'what' (find the right Azure RBAC role with least privilege, generate CLI commands and Bicep code, provide permissions guidance) and 'when' (explicit WHEN clause with multiple trigger phrases). | 3 / 3 |
Trigger Term Quality | Excellent coverage of natural trigger terms users would say: 'what role should I assign', 'least privilege role', 'RBAC role for', 'role to read blobs', 'role for managed identity', 'custom role definition', 'assign role to identity', 'what role do I need to grant access', 'permissions to assign roles'. These are realistic phrases users would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche: Azure RBAC role assignment with least privilege. The combination of Azure RBAC, Bicep code, CLI commands, and managed identity terminology makes it very unlikely to conflict with other skills. | 3 / 3 |
Total | 12 / 12 Passed |
Implementation
57%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
The skill provides a reasonable high-level workflow for finding and assigning Azure RBAC roles using specific tools, but lacks concrete examples (sample tool calls, expected outputs, or Bicep/CLI snippets) that would make it truly actionable. The workflow would benefit from explicit step numbering and a validation checkpoint to confirm the selected role before generating assignment code.
Suggestions
Add explicit numbered steps for the workflow (1. Find role via azure__documentation, 2. Confirm role matches, 3. Generate CLI, 4. Generate Bicep) with a validation checkpoint after role selection.
Include a concrete example showing a sample user request (e.g., 'I need a role to read blobs'), the expected tool call sequence, and a representative output snippet.
Add a brief example of what a custom role definition looks like when no built-in role matches, so Claude has a concrete template to work from.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Mostly efficient but includes some unnecessary explanation in the Prerequisites section (e.g., 'full access including role assignment' for Owner is something Claude already knows). The tool-chaining instructions are reasonably lean. | 2 / 3 |
Actionability | Provides a clear sequence of which tools to use and when, but lacks concrete examples of tool invocations, expected inputs/outputs, or sample CLI/Bicep snippets. The guidance is directional rather than copy-paste ready. | 2 / 3 |
Workflow Clarity | There is an implicit multi-step workflow (find role → generate CLI → generate Bicep), but steps are not explicitly numbered or sequenced, and there are no validation checkpoints (e.g., confirming the role matches before generating assignment code). | 2 / 3 |
Progressive Disclosure | For a skill of this size (~15 lines of content), the structure is appropriate with a concise overview followed by a clearly labeled Prerequisites section. No unnecessary nesting or monolithic walls of text. | 3 / 3 |
Total | 9 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- jonathan-vella/azure-agentic-infraops
- Commit
ec7b8ff
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.