auditing-cloud-with-cis-benchmarks

Audit AWS, Azure, and GCP environments against the CIS Foundations Benchmarks by running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation for continuous compliance. Use when conducting a cloud security audit, validating CIS benchmark compliance (CIS v5 AWS, v4 Azure, v4 GCP), or setting up continuous cloud compliance monitoring.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/auditing-cloud-with-cis-benchmarks/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a strong, command-heavy runbook with clear sectioning and broadly executable guidance, but it is held back by missing post-remediation validation for destructive batch operations, unreferenced bundle files, and inline time-sensitive version/date information. Addressing validation and bundle-file navigation would lift the weakest dimensions.

Suggestions

Add an explicit post-remediation validation checkpoint (e.g., re-run Prowler or scripts/agent.py and confirm previously-failed controls now PASS) as Step 4.5/Step 5 — destructive/batch remediation without verification caps workflow clarity.

Link the existing bundle files from the body: point to scripts/agent.py for the ready-made audit runner and references/api-reference.md for the boto3 check methods, rather than inlining every command in SKILL.md.

Move time-sensitive values (CIS v5.0/v4.0, Prowler v4.3.0, the 2025-02-23 sample date) into a clearly labeled versions/deprecated section or trim them, so staleness does not burden the core instructions.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean command-driven content, but the Key Concepts table defines terms Claude largely knows ('Automated Assessment', 'Compliance Score') and time-sensitive values (CIS v5.0/v4.0, Prowler v4.3.0, 'Assessment Date: 2025-02-23') sit inline rather than in a deprecated/old-patterns section, which the guidelines penalize; not a 4 because the version/date overhead and definitional padding are noticeable rather than minor.	3 / 5
Actionability	Extensive copy-paste-ready commands across AWS/Azure/GCP (prowler, jq parsers, aws/az CLI, cron) cover common cases, but 'scout suite aws' (should be 'scoutsuite') and placeholder ARNs/account IDs are minor executability gaps; not a 5 because of that one non-executable command and the placeholders, not a 3 because the bulk is concrete and runnable.	4 / 5
Workflow Clarity	The five steps are clearly sequenced (select benchmark, scan, interpret, remediate, monitor), but remediation is a destructive/batch operation (deleting root keys, re-encrypting S3, creating CloudTrail, assigning Azure Policy across 45 accounts) with no explicit post-remediation validation/re-scan checkpoint, so the destructive-ops cap applies; not a 4 because validation is missing rather than merely implicit.	3 / 5
Progressive Disclosure	Section structure is clear (When to Use, Prerequisites, Workflow, Key Concepts, Tools, Scenarios, Output Format), but the provided bundle files references/api-reference.md and scripts/agent.py are never linked from the body, so a ready-made audit script and API reference go un-signaled; not a 4 because failing to point to existing bundle files is more than a minor organization gap, not a 2 because headers give real structure.	3 / 5
	Total	13 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: third-person voice, concrete named-tool actions across three clouds, and an explicit 'Use when' clause with natural trigger phrases including specific benchmark versions. It matches the rubric's good examples on every dimension with no padding or over-claims.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('running automated scans with tools like Prowler and ScoutSuite, interpreting failed controls, and tracking remediation') plus named tools and three cloud providers, matching the comprehensive-coverage anchor; not a 4 because coverage is full rather than having minor gaps.	5 / 5
Completeness	Explicitly answers both what ('Audit AWS, Azure, and GCP environments... interpreting failed controls... tracking remediation') and when ('Use when conducting a cloud security audit, validating CIS benchmark compliance...') with concrete triggers; not a 4 because the 'when' is fully explicit, not merely adequate.	5 / 5
Trigger Term Quality	Natural trigger phrases ('cloud security audit', 'CIS benchmark compliance', 'continuous cloud compliance monitoring') plus synonyms and specific version identifiers give comprehensive coverage users would actually say; not a 4 because it goes beyond a few missing terms.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (CIS Foundations Benchmarks via Prowler/ScoutSuite across named clouds) with distinct triggers and minimal overlap with adjacent security skills; not a 4 because the triggers are tightly scoped with little conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/auditing-cloud-with-cis-benchmarks/SKILL.md
Commit: 54a7988

Reviewed: ~2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.