CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

aws-iam

Verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Use alongside documentation when working with IAM roles, policies, STS, or Organizations. Do NOT use for non-IAM authorization like Cognito user-pool policies or app-level RBAC.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

90%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exemplary corrections-style skill body: dense, verified, non-obvious facts organized by service topic with actionable fix directives and a copy-paste-ready policy example, plus a brief verification policy in the About section. The only soft spots are the absence of any explicit workflow sequencing (acceptable for a reference skill) and inline content that could eventually be split into reference files as it grows.

DimensionReasoningScore

Conciseness

The body is lean and dense: every bullet is a specific, verified fact Claude cannot reliably recall (e.g., "DuplicatePolicyAttachmentException (not PolicyAlreadyAttachedException)", "Role chaining: max 1-hour session", "Managed policy max versions: 5"), with zero padding and no explanation of IAM basics. This matches anchor 5 — every token earns its place.

5 / 5

Actionability

Guidance is concrete and executable throughout: exact API and method names ("activate(), deactivate(), delete() — NO update()"), exact operational orders ("Remove FIRST, then close"), exact URL formats, a complete copy-paste-ready JSON policy for the ForAllValues/Null edge case, and explicit fix directives ("include BOTH redshift-serverless.amazonaws.com AND redshift.amazonaws.com"). Per the rubric's code-vs-instruction note, this fully matches anchor 5.

5 / 5

Workflow Clarity

This is a single-purpose corrections reference rather than a multi-step workflow skill, and its one operating procedure is unambiguous: "verify specific claims... against official AWS documentation rather than relying on pre-training. Prefer fetching known documentation URLs over broad searches. Trust official documentation over memory when they conflict." No destructive or batch operations exist to trigger the validation cap, but there is no explicit sequencing of when each section applies, placing it between anchors 3 and 4 — noticeably above the midpoint.

4 / 5

Progressive Disclosure

No bundle files exist, and the ~85-line body is well organized with per-topic section headers (CloudTrail, STS, Organizations, SDK Specifics, SAML, Policy Evaluation, MFA, SigV4, Service-Specific Roles, Policy Summary Display) plus a single clearly signaled one-level-deep AWS docs link. Content is appropriately inline at this size, matching anchor 4; per-topic deep-dive material (e.g., policy evaluation) could eventually justify splitting into reference files as the skill grows.

4 / 5

Total

18

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states a precise purpose, enumerates concrete coverage areas, gives an explicit "Use alongside documentation when..." trigger clause, and adds a negative boundary to prevent mis-triggering. The only minor gaps are a few missing natural trigger variations such as "permissions" or "AssumeRole".

DimensionReasoningScore

Specificity

The description enumerates several concrete capability areas ("policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics") rather than generic filler, matching anchor 4. It falls short of anchor 5 because it lists topic categories rather than a fully comprehensive inventory of the specific corrections it contains.

4 / 5

Completeness

It explicitly answers both "what" ("Verified corrections for IAM behaviors that AI agents frequently get wrong" with concrete categories) and "when" ("Use alongside documentation when working with IAM roles, policies, STS, or Organizations") with concrete trigger phrases, plus an explicit negative boundary. This squarely matches anchor 5.

5 / 5

Trigger Term Quality

It includes the natural terms users say in this domain ("IAM roles, policies, STS, or Organizations" plus SAML and MFA), giving good keyword coverage. A few natural variations are missing (e.g., "permissions", "AssumeRole", "trust policy" as a trigger phrase), so it fits anchor 4 rather than 5.

4 / 5

Distinctiveness Conflict Risk

It occupies a clear niche (IAM-specific verified corrections) and actively reduces conflict risk with the clause "Do NOT use for non-IAM authorization like Cognito user-pool policies or app-level RBAC", matching anchor 5's minimal conflict risk.

5 / 5

Total

18

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

13

/

16

Passed

Repository

mreferre/aws-agent-toolkit-skills

Path

.kiro/skills/aws-iam/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.