analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-cloud-storage-access-patterns/SKILL.md

Quality

Content

68%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, largely actionable body backed by real bundle files and concrete detection thresholds. Its main weakness is workflow clarity: the batch analysis pipeline lacks any validation/feedback checkpoint before reporting, capping that dimension at 3.

Suggestions

Add a validation step before report generation (e.g. 'Review alerts to exclude known-good service accounts and verify bulk-download counts before reporting') so the workflow has an explicit checkpoint.

Link references/api-reference.md from the Instructions section (e.g. 'For full CloudTrail query syntax and event names, see references/api-reference.md') so the existing bundle file is clearly signaled.

Tighten the 'When to Use' bullets to remove overlap with the description and drop the generic 'structured procedures' phrasing.

Dimension	Reasoning	Score
Conciseness	The body is lean with concrete thresholds and no padding about concepts Claude already knows; the 'When to Use' bullets are slightly generic ('When SOC analysts need structured procedures') and overlap the description, leaving minor trims.	4 / 5
Actionability	Provides an executable command ('python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json') backed by a real script, plus concrete thresholds (>100 GetObject/hr, 8am-6pm, 30-day baseline); step 2 ('Query CloudTrail...using AWS CLI or boto3') stays high-level rather than giving the exact command inline.	4 / 5
Workflow Clarity	Five sequenced steps are present, but this batch analysis workflow has no validation/verification checkpoint (e.g. confirming alerts aren't false positives before reporting), so per the rubric cap workflow clarity at 3.	3 / 5
Progressive Disclosure	Clear section structure (When to Use, Prerequisites, Instructions, Examples) with a real scripts/agent.py referenced via command; however references/api-reference.md exists as a bundle file but is not signaled or linked from the body, a minor organization gap.	4 / 5
	Total	15 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete detection actions across AWS, GCP, and Azure and pairs them with an explicit Use-when clause. Trigger-term coverage is good though a few natural synonyms are missing, and the detection-rules trigger slightly broadens conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across three clouds—'analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics' for 'after-hours bulk downloads, new-IP access, and API-call spikes' via 'statistical baselines and time-series anomaly detection'—giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what ('Detect abnormal access...via statistical baselines and time-series anomaly detection') and when ('Use when investigating suspected cloud data exfiltration or building related detection rules') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Strong natural terms users would say ('cloud data exfiltration', 'detection rules', 'AWS S3', 'GCS', 'Azure Blob Storage', 'GetObject', 'bulk downloads'); a few common synonyms (e.g. 'threat hunting', 'data leak') are absent, keeping it just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	The cloud-storage-exfiltration niche is distinct with specific triggers, but 'building related detection rules' is broad enough to risk minor overlap with general cloud-security monitoring skills.	4 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-cloud-storage-access-patterns/SKILL.md
Commit: 54a7988

Reviewed: ~2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.