auditing-aws-s3-bucket-permissions
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
83
80%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/auditing-aws-s3-bucket-permissions/SKILL.mdQuality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong, highly specific description that clearly articulates concrete capabilities and names specific tools, making it very distinctive. Its main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill. The description reads as a single dense sentence that could benefit from structural separation of what vs. when.
Suggestions
Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about S3 security, bucket access audits, public bucket exposure, or AWS storage compliance checks.'
Consider breaking the single sentence into a capabilities statement and a trigger statement for improved readability and selection accuracy.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: audit S3 bucket permissions, identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, missing encryption settings. Also names specific tools: AWS CLI, S3audit, and Prowler. | 3 / 3 |
Completeness | Clearly answers 'what does this do' with detailed capabilities, but lacks an explicit 'Use when...' clause or equivalent trigger guidance. The 'when' is only implied by the nature of the actions described. | 2 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'S3 bucket permissions', 'publicly accessible buckets', 'ACLs', 'bucket policies', 'encryption settings', 'AWS CLI', 'S3audit', 'Prowler', 'least-privilege'. These cover a good range of terms a user concerned about S3 security would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly specific niche: AWS S3 bucket security auditing with named tools. Very unlikely to conflict with other skills given the narrow focus on S3 permissions, ACLs, bucket policies, and specific tooling like S3audit and Prowler. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a strong, actionable skill with executable commands throughout a well-sequenced 7-step audit workflow. Its main weaknesses are moderate verbosity from sections explaining concepts Claude already knows (Key Concepts table, Tools descriptions) and a monolithic structure that could benefit from splitting reference material into separate files. The output format example and common scenario add practical value.
Suggestions
Remove or significantly trim the 'Key Concepts' table — Claude already knows what bucket policies, ACLs, and server-side encryption are. Keep only project-specific or non-obvious definitions.
Move the 'Tools & Systems' and 'Common Scenarios' sections to separate referenced files to improve progressive disclosure and reduce the main skill's token footprint.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is reasonably well-structured but includes some unnecessary content for Claude. The 'Key Concepts' table explains terms like 'Bucket Policy' and 'ACL' that Claude already knows well. The 'Tools & Systems' section similarly describes tools at a level Claude doesn't need. The 'When to Use' and 'Do not use' sections are somewhat verbose. However, the core workflow steps are fairly efficient with executable commands. | 2 / 3 |
Actionability | The skill provides fully executable bash commands and Python snippets throughout all workflow steps. Commands are copy-paste ready with proper AWS CLI syntax, JMESPath queries, and inline Python for policy analysis. Remediation commands in Step 7 are concrete and specific. | 3 / 3 |
Workflow Clarity | The 7-step workflow is clearly sequenced from enumeration through analysis to remediation. Steps build logically on each other. The common scenario includes a feedback loop (check ACL → check policy → confirm Block Public Access → enumerate contents → remediate → verify via CloudTrail). The pitfalls section warns about breaking changes from remediation, serving as an implicit validation checkpoint. | 3 / 3 |
Progressive Disclosure | The content is well-organized with clear sections and headers, but it's monolithic — everything is in one file with no references to external resources for deeper dives. The Key Concepts table, Tools & Systems section, and Common Scenarios could be split into separate reference files. For a skill of this length (~180+ lines of substantive content), some progressive disclosure to external files would improve navigability. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.