analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

80%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and highly actionable with concrete commands and a real bundled script, but the workflow lacks validation/feedback checkpoints for a batch operation and the existing api-reference.md is orphaned rather than navigated from the overview.

Suggestions

Add an explicit validation/verification step to the workflow (e.g., confirm CloudTrail returned events and the baseline has enough history before trusting anomaly scores), with a fix-and-retry loop for failed queries.

Link references/api-reference.md from the body (e.g., under an 'API reference' line) and move the inline thresholds and event-structure detail there so the overview stays a lean entry point.

Note the multi-cloud scope gap: the script and instructions cover S3/CloudTrail in depth but only name GCS and Azure in the description — either add a pointer to per-cloud guidance or scope the body to what it actually executes.

Dimension	Reasoning	Score
Conciseness	The body is lean — it never explains concepts Claude already knows (no definition of CloudTrail or S3) and assumes competence, fitting the 'lean and efficient; every token earns its place' anchor rather than the padded score-2 anchor.	3 / 3
Actionability	Provides a copy-paste command ('python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json'), concrete thresholds (>100 GetObject/hr, 8am-6pm, 30-day baseline), and a complete executable bundled script, matching the fully-executable score-3 anchor.	3 / 3
Workflow Clarity	The five-step sequence (install, query, baseline, detect, report) is clearly listed, but for a batch log-analysis operation there is no validation/verification checkpoint or error-feedback loop, which the rubric notes cap at 2; it is not 1 because the sequence is present and complete.	2 / 3
Progressive Disclosure	The body is well-sectioned and signals scripts/agent.py, but the bundled references/api-reference.md is never linked from the body and content that could live there (event structure, thresholds) is inlined, matching the 'references present but not clearly signaled; content that should be separate is inline' score-2 anchor rather than the well-signaled score-3 anchor.	2 / 3
	Total	10 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and complete: it names concrete detection actions across three cloud providers, includes a clear 'Use when' trigger, and occupies a distinct niche. It is a strong, low-conflict description.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions and targets — 'Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection' — matching the multi-action score-3 anchor rather than the partial score-2 anchor.	3 / 3
Completeness	Explicitly answers both 'what' (detect abnormal access via named log sources and methods) and 'when' ('Use when investigating suspected cloud data exfiltration or building related detection rules'), matching the explicit-trigger score-3 anchor and exceeding the score-2 anchor where 'when' is only implied.	3 / 3
Trigger Term Quality	Covers natural terms a SOC analyst would say — 'AWS S3,' 'GCS,' 'Azure Blob Storage,' 'CloudTrail,' 'after-hours bulk downloads,' 'new-IP access,' 'cloud data exfiltration,' 'detection rules' — giving good coverage rather than the jargon-only or partial-keyword lower anchors.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (multi-cloud storage exfiltration detection) with distinct triggers unlikely to fire for unrelated skills, matching the score-3 'clear niche with distinct triggers' anchor rather than the overlapping score-2 anchor.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-cloud-storage-access-patterns/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.