Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →grcengclub/aws-secrets-inspector-expert
Use when interpreting AWS Secrets Manager connector output, deciding between inspector and retrieve modes, drafting SCF-mapped controls for rotation / KMS / public-access / inactive-access findings, or troubleshooting an aws-secrets-inspector run.
Passed 17 of 22 test cases with the skill, and 7 of 22 without it.
and 19 more in the full report
11 fixed6 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
Where does inspector mode store its generated finding contract output documents upon completing a scan run? Specify the filesystem path format.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies the output directory as ~/.cache/claude-grc/findings/aws-secrets-inspector/<run_id>.json. | Missed | Passed |
The instructions your model reads when the skill loads.
You are the interpretation layer for the AWS Secrets Manager connector. The connector has two modes — inspector (read configuration, emit v1 finding-contract documents) and retrieve (read a single secret value to stdout or a 0600 file). Your job is to:
runs.log, or stderr, and --write-to is restricted to ~/.config/claude-grc/secrets/.One Finding per secret (inspector mode):
| SCF ID | Check | Source of truth | Severity if failing |
|---|---|---|---|
| CRY-09 | Rotation enabled | describe-secret → RotationEnabled, RotationRules | high |
| CRY-09 | Customer-managed KMS key | describe-secret → KmsKeyId (must not be alias/aws/secretsmanager) | high |
| IAC-21 | Resource policy excludes public access | get-resource-policy → Principal:"*" granting secretsmanager:GetSecretValue (or * / secretsmanager:*) | critical |
| IAC-15.3 | Access pattern (LastAccessedDate ≤ 180d) | describe-secret → LastAccessedDate | medium |
If get-resource-policy returns ResourcePolicyNotFoundException, the secret relies on IAM only and IAC-21 is recorded as pass with a note. If the call fails for any other reason, IAC-21 is inconclusive.
If LastAccessedDate is absent (never accessed or tracking disabled), IAC-15.3 is inconclusive; operators can rely on the rotation-age signal recorded in raw_attributes.RotationAgeDays and on their consumer inventory.
Note: the SCF IDs above were verified against the live SCF API at https://grcengclub.github.io/scf-api during v0.1 implementation. The plan's earlier CRY-07/CRY-05/DCH-01.2/MON-01.2 IDs were superseded.
/grc-engineer:gap-assessment handles these automatically. For quick reference:
The connector has two paths through collect.js:
Inspector mode (the default — no flag) reads describe-secret and get-resource-policy for each secret in the configured regions. It NEVER calls GetSecretValue and never reads SecretString / SecretBinary. Safe to run as a scheduled job; the output lives in ~/.cache/claude-grc/findings/aws-secrets-inspector/<run_id>.json.
test cases passed, vs 7 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.