Tessl • The management layer for AI agent skills

SkillPublic

creating-secrets-using-best-practices

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

The canonical home for this skill is creating-secrets-using-best-practices in aws/agent-toolkit-for-aws

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, token-efficient overview that delegates the detailed SOP to a single verified, one-level-deep reference with a properly sequenced and validated workflow. The recurring theme is that the body is a pure router: almost all executable detail and the workflow sequence live in the reference, with minor redundancy and no inline workflow summary.

Suggestions

Trim the Overview, which repeats the frontmatter description nearly word-for-word, and cut filler like "Each type is structured appropriately" (conciseness).

Add a one-line inline outline of the six procedure steps (verify dependencies → KMS key → create secret → rotation → IAM policy → CloudTrail) so the workflow shape is visible without opening the reference (workflow_clarity, actionability).

Include one small inline code snippet or command (e.g., the aws secretsmanager create-secret call with key parameters) for the most common case so the body is actionable on its own (actionability).

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes competence, but the Overview restates the frontmatter description almost verbatim ("KMS encryption, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management") and "Each type is structured appropriately" is filler. Minor trimming opportunities keep this below anchor 5's every-token-earns-its-place bar.	4 / 5
Actionability	The body directs the reader to a fully executable referenced procedure and the troubleshooting sections name concrete checks ("kms:CreateKey and kms:PutKeyPolicy permissions", "scoped with kms:ViaService to secretsmanager.<region>.amazonaws.com", "Review CloudWatch logs"). The body itself contains no commands or examples — a minor gap that fits anchor 4 rather than anchor 5's copy-paste-ready standard.	4 / 5
Workflow Clarity	The referenced procedure (references/create-secrets-using-best-practices.md) lays out a clearly sequenced 6-step workflow with explicit validation checkpoints ("You MUST confirm successful acquisition of all parameters before proceeding", "You MUST test the rotation configuration by triggering an initial rotation") and error handling, and the body routes to it unambiguously ("follow the procedure exactly"). It sits below anchor 5 only because the body itself carries no sequence or checkpoint summary, requiring a file open to see the workflow shape.	4 / 5
Progressive Disclosure	The body is a concise overview with a single well-signaled, one-level-deep reference — [secret creation procedure](references/create-secrets-using-best-practices.md) — that exists at the exact linked path (verified against the bundle) and itself contains no nested references. Sections (Overview, Create, Troubleshooting) are well organized and easy to navigate, matching anchor 5.	5 / 5
	Total	17 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with concrete, comprehensive capability statements, an explicit "Always use this skill when creating secrets" trigger, and a distinct AWS Secrets Manager niche. The main gap is trigger breadth: only the creation verb is covered, with no synonyms like credentials, passwords, or API keys.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions — "sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management" — covering the full secret-handling lifecycle. Coverage is comprehensive rather than having the minor gaps of anchor 4.	5 / 5
Completeness	Both are answered: the "what" is concrete ("Creates and manages secrets in AWS Secrets Manager" plus the named controls) and the "when" is explicit ("Always use this skill when creating secrets"). Not 5 because there is only a single trigger condition covering creation — no triggers for managing, rotating, or retrieving secrets — whereas anchor 5 lists multiple concrete trigger phrases.	4 / 5
Trigger Term Quality	Natural terms users would say are present ("creating secrets", "AWS Secrets Manager", "KMS", "rotation"), but common synonyms a user might actually say — "credentials", "passwords", "API keys", "store securely" — are absent. Keyword coverage is good but short of the synonym/extension comprehensiveness of anchor 5, and well above the sparse anchor 3.	4 / 5
Distinctiveness Conflict Risk	It occupies a clear niche — AWS Secrets Manager secret creation with named AWS-specific controls (KMS, IAM, CloudTrail) — so it is unlikely to trigger for the wrong skill. Triggers are distinct with minimal conflict risk, matching anchor 5.	5 / 5
	Total	18 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning
metadata_field	'metadata' should map string keys to string values	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	13 / 16 Passed

Repository: mreferre/aws-agent-toolkit-skills
Path: .kiro/skills/creating-secrets-using-best-practices/SKILL.md
Revision: 2d9ee5d

Reviewed: 1 day ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

creating-secrets-using-best-practices

Table of Contents

Is this your skill?