auditing-cloud-with-cis-benchmarks
This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
78
73%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/auditing-cloud-with-cis-benchmarks/SKILL.mdQuality
Discovery
82%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a strong description with excellent specificity, naming concrete tools, cloud providers, benchmark versions, and specific actions. Its main weakness is the absence of an explicit 'Use when...' clause, which would help Claude know exactly when to select this skill. The domain is niche enough that conflict risk is minimal.
Suggestions
Add an explicit 'Use when...' clause, e.g., 'Use when the user asks about CIS benchmark compliance, cloud security audits, Prowler or ScoutSuite assessments, or hardening AWS/Azure/GCP environments against CIS controls.'
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Lists multiple specific concrete actions: interpreting CIS Foundations Benchmark controls, running automated assessments with named tools (Prowler, ScoutSuite), remediating failed controls, and maintaining continuous compliance monitoring. Also specifies exact benchmark versions. | 3 / 3 |
Completeness | Clearly answers 'what does this do' with detailed capabilities, but lacks an explicit 'Use when...' clause or equivalent trigger guidance. The 'when' is only implied by the nature of the described tasks, which per the rubric caps completeness at 2. | 2 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'cloud security audit', 'CIS benchmarks', 'AWS', 'Azure', 'GCP', 'Prowler', 'ScoutSuite', 'compliance monitoring', 'CIS Foundations Benchmark', and specific version numbers. Good coverage of terms a user working in cloud security would naturally use. | 3 / 3 |
Distinctiveness Conflict Risk | Highly distinctive with a clear niche: CIS benchmark-based cloud security audits across specific cloud providers with named tools and specific benchmark versions. Unlikely to conflict with other skills due to the very specific domain focus. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
64%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a solid, actionable skill with real executable commands covering the full CIS audit lifecycle across AWS, Azure, and GCP. Its main weaknesses are the lack of post-remediation validation steps (no re-scan to confirm fixes), some verbose explanatory content that Claude doesn't need, and a monolithic structure that could benefit from splitting detailed content into referenced files.
Suggestions
Add an explicit validation step after remediation: re-run Prowler for specific failed controls and verify they now pass before proceeding (e.g., 'prowler aws --checks <control-id> --compliance cis_5.0_aws')
Remove or significantly trim the Key Concepts table — Claude already knows what terms like 'Automated Assessment', 'Compliance Score', and 'Remediation Runbook' mean
Split per-provider remediation examples and the Common Scenarios section into separate referenced files (e.g., REMEDIATION-AWS.md, SCENARIOS.md) to reduce the main skill's token footprint
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is reasonably efficient but includes some unnecessary content. The Key Concepts table explains terms Claude already knows (e.g., what a CIS Benchmark is, what 'Automated Assessment' means). The Tools & Systems section also restates obvious information. The CIS Profile Levels explanation is somewhat redundant. However, the core workflow and commands are well-targeted. | 2 / 3 |
Actionability | The skill provides fully executable bash commands for Prowler scans, jq parsing, AWS CLI remediation, and continuous monitoring setup across all three cloud providers. Commands are copy-paste ready with specific flags, output formats, and real CIS control IDs referenced. | 3 / 3 |
Workflow Clarity | The 5-step workflow is clearly sequenced and logical. However, Step 4 (remediation) lacks explicit validation checkpoints — there's no 'verify the fix worked' step after applying remediations, and no feedback loop for re-running the assessment to confirm controls now pass. For destructive/batch operations like the S3 encryption loop, this is a significant gap. | 2 / 3 |
Progressive Disclosure | The content is well-structured with clear sections and headers, but it's quite long (~200+ lines) with everything inline. The Key Concepts table, Common Scenarios section, and Output Format could be split into separate reference files. The 'Do not use' section references other skills but the main content doesn't leverage external files for detailed remediation runbooks or per-provider guides. | 2 / 3 |
Total | 9 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Commit
c15f73d
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.