auditing-aws-s3-bucket-permissions

Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/auditing-aws-s3-bucket-permissions/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a highly actionable, well-sequenced audit runbook with executable commands throughout, but it loses points for missing validation checkpoints on batch/destructive operations, some over-explanation of well-known concepts, and bundle files that are never linked from the body.

Suggestions

Add explicit validation/verification after remediation (e.g., re-run get-public-access-block / get-bucket-encryption to confirm the change took effect) to satisfy the destructive/batch feedback-loop requirement.

Link the existing bundle files from the body (e.g., 'See references/api-reference.md for full CLI flag details' and 'See scripts/agent.py for an automated cross-account runner') so progressive disclosure is one level deep and signaled.

Trim the Key Concepts / Tools & Systems tables to only terms Claude would not already know, reducing token overhead.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with one-line step intros followed by executable code, but the 'Key Concepts' and 'Tools & Systems' sections explain notions Claude already knows (ACL, Bucket Policy, Server-Side Encryption, CIS Benchmark), adding padding that could be trimmed.	3 / 5
Actionability	Every step ships copy-paste-ready, executable AWS CLI / Prowler / Access Analyzer commands with concrete flags and filters, and remediation commands cover the common cases end-to-end.	5 / 5
Workflow Clarity	The seven steps are clearly sequenced, but the skill runs batch loops over all buckets and performs destructive remediation (put-public-access-block, put-bucket-encryption, put-bucket-versioning) with no validation/verification that changes applied correctly, so workflow clarity is capped at 3 per the rubric's destructive/batch rule.	3 / 5
Progressive Disclosure	The body is sectioned (When to Use, Prerequisites, Workflow, Key Concepts, Tools, Scenarios, Output Format), but bundle files references/api-reference.md and scripts/agent.py exist yet are never referenced or linked from the body, leaving them orphaned and signaling poor cross-file navigation.	3 / 5
	Total	14 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, tool-named, and well-scoped to a distinct S3 permission-auditing niche, but it lacks any explicit 'when to use' trigger guidance, which limits its completeness. Adding a 'Use when...' clause would lift it from a strong partial to a complete description.

Suggestions

Append an explicit trigger clause such as 'Use when auditing AWS S3 bucket security, responding to S3 exposure alerts, or preparing for compliance reviews (SOC 2, PCI DSS, HIPAA).'

Add a few natural user synonyms (e.g., 'S3 security review', 'public bucket check') to broaden trigger-term coverage.

Trim trailing whitespace/newlines in the description YAML to keep it clean.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings') plus named tools ('AWS CLI, S3audit, and Prowler') and an enforcement goal, giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Provides a clear 'what' (audit S3 permissions to identify specific misconfigurations via named tools to enforce least-privilege) but has no 'Use when...' or equivalent explicit 'when' guidance, which caps completeness at 3 per the rubric guidelines.	3 / 5
Trigger Term Quality	Strong natural keywords ('AWS S3 bucket permissions', 'publicly accessible buckets', 'ACLs', 'bucket policies', 'encryption', 'Prowler') that a user would plausibly say, though a few common variants ('S3 security', 'bucket access review') and an explicit trigger phrase are absent.	4 / 5
Distinctiveness Conflict Risk	A clearly scoped niche ('audit AWS S3 bucket permissions' for specific misconfigurations) with distinct triggers and minimal overlap risk against other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/auditing-aws-s3-bucket-permissions/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.