auditing-cloud-with-cis-benchmarks

This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.

Quality

73%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

Securityby

Passed

No known issues

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/auditing-cloud-with-cis-benchmarks/SKILL.md

Quality

Discovery

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is a strong description with excellent specificity, naming concrete tools (Prowler, ScoutSuite), specific benchmark versions (CIS v5 for AWS, v4 for Azure/GCP), and clear actions. Its main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill. The domain-specific terminology provides excellent distinctiveness and trigger term coverage.

Suggestions

Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about CIS benchmarks, cloud security audits, compliance checks for AWS/Azure/GCP, or running Prowler or ScoutSuite assessments.'

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: interpreting CIS Foundations Benchmark controls, running automated assessments with named tools (Prowler, ScoutSuite), remediating failed controls, and maintaining continuous compliance monitoring. Also specifies exact benchmark versions.	3 / 3
Completeness	Clearly answers 'what does this do' with detailed capabilities, but lacks an explicit 'Use when...' clause or equivalent trigger guidance. The 'when' is only implied by the nature of the described tasks.	2 / 3
Trigger Term Quality	Includes strong natural keywords users would say: 'cloud security audit', 'CIS benchmarks', 'AWS', 'Azure', 'GCP', 'Prowler', 'ScoutSuite', 'compliance monitoring', 'CIS Foundations Benchmark', and specific version numbers. These cover a wide range of terms a user working in this domain would naturally use.	3 / 3
Distinctiveness Conflict Risk	Highly distinctive with a clear niche: CIS benchmark-based cloud security audits across specific cloud providers with named tools and specific benchmark versions. Very unlikely to conflict with other skills.	3 / 3
	Total	11 / 12 Passed

Implementation

64%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

This is a solid, actionable skill with real executable commands covering the full CIS audit lifecycle across AWS, Azure, and GCP. Its main weaknesses are the lack of validation/verification steps after remediation (no re-scan to confirm fixes), some verbose definitional content that Claude doesn't need, and a monolithic structure that could benefit from splitting detailed remediation and scenario content into referenced files.

Suggestions

Add an explicit validation step after Step 4 remediation: re-run Prowler on remediated controls and compare before/after compliance scores to confirm fixes took effect.

Remove or significantly trim the Key Concepts table—terms like 'Automated Assessment', 'Compliance Score', and 'Remediation Runbook' are self-evident to Claude and waste tokens.

Split detailed remediation commands and the Common Scenarios section into separate referenced files (e.g., REMEDIATION.md, SCENARIOS.md) to keep SKILL.md as a concise overview.

Dimension	Reasoning	Score
Conciseness	The skill is reasonably efficient but includes some unnecessary content. The Key Concepts table defines terms Claude already knows (e.g., 'Automated Assessment', 'Compliance Score'), and the CIS Profile Levels explanation is somewhat verbose. The Tools & Systems section also restates what's evident from context. However, the core workflow and commands are well-targeted.	2 / 3
Actionability	The skill provides fully executable bash commands for Prowler scans, jq parsing, AWS CLI remediation, and continuous monitoring setup across all three cloud providers. Commands are copy-paste ready with specific flags, output formats, and real CIS control IDs referenced.	3 / 3
Workflow Clarity	The 5-step workflow is clearly sequenced and logically ordered from benchmark selection through continuous monitoring. However, there are no explicit validation checkpoints after remediation steps—Step 4 applies fixes but never re-runs the assessment to verify fixes worked. For destructive/batch operations like the S3 encryption loop, there's no pre-check or rollback guidance, which caps this at 2.	2 / 3
Progressive Disclosure	The content is well-structured with clear sections and headers, but it's quite long (~200+ lines) with inline content that could be split out—the Common Scenarios section, the full Output Format template, and the remediation commands for each CIS control could be referenced as separate files. The 'Do not use' section references other skills but the main body doesn't leverage progressive disclosure for its own detailed content.	2 / 3
	Total	9 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Commit: 888bbe4

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.