Add Vault product with 6 plugins and 16 skills

[MrFixit96]

Summary

Add Vault as the third product after Terraform and Packer with job-oriented plugin naming and decision framework-driven skills.

Design Approach

This PR encodes "tacit knowledge" and reduces the "3-4 documentation hops" users typically need by:

1. Job-oriented plugin names — named for what users are trying to accomplish (matching Terraform/Packer patterns)
2. "What Are You Trying to Solve?" decision frameworks — every skill starts by routing users to the right solution
3. Mental model sections — explaining how each component works before diving into reference material

Structure

vault/
├── README.md
├── credential-generation/
│   ├── .claude-plugin/plugin.json
│   ├── SPEC.md
│   └── skills/
│       ├── secrets-engines/
│       │   ├── SKILL.md
│       │   └── references/secrets-engines.md
│       └── vault-agent/
│           ├── SKILL.md
│           └── references/vault-agent.md
├── app-access/
│   ├── .claude-plugin/plugin.json
│   ├── SPEC.md
│   └── skills/
│       ├── auth-methods/
│       │   ├── SKILL.md
│       │   └── references/auth-methods.md
│       ├── policies/
│       │   ├── SKILL.md
│       │   └── references/policies.md
│       ├── token-management/
│       │   ├── SKILL.md
│       │   └── references/token-management.md
│       ├── identity-system/
│       │   ├── SKILL.md
│       │   └── references/identity-system.md
│       └── response-wrapping/
│           ├── SKILL.md
│           └── references/response-wrapping.md
├── deployment/
│   ├── .claude-plugin/plugin.json
│   ├── SPEC.md
│   └── skills/
│       ├── kubernetes-integration/
│       │   ├── SKILL.md
│       │   └── references/kubernetes.md
│       ├── production-operations/
│       │   ├── SKILL.md
│       │   └── references/
│       │       ├── production-operations.md
│       │       └── enterprise.md
│       └── troubleshooting/
│           ├── SKILL.md
│           └── references/troubleshooting.md
├── multi-tenancy/
│   ├── .claude-plugin/plugin.json
│   ├── SPEC.md
│   └── skills/
│       └── enterprise-features/
│           ├── SKILL.md
│           └── references/enterprise.md
├── ai-workflows/
│   ├── .claude-plugin/plugin.json
│   ├── SPEC.md
│   └── skills/
│       ├── vault-mcp-server/
│       │   ├── SKILL.md
│       │   └── references/vault-mcp-server.md
│       └── mcp-secrets-workflows/
│           ├── SKILL.md
│           └── references/mcp-secrets-workflows.md
└── hashicorp-secrets-engines/
    ├── .claude-plugin/plugin.json
    ├── SPEC.md
    └── skills/
        ├── consul-secrets/
        │   ├── SKILL.md
        │   └── references/consul-secrets.md
        ├── nomad-secrets/
        │   ├── SKILL.md
        │   └── references/nomad-secrets.md
        └── terraform-cloud-secrets/
            ├── SKILL.md
            └── references/terraform-cloud-secrets.md

Plugins (6)

All plugins are v0.2.0, named for the job the user is trying to accomplish:

Plugin Name	Directory	User Intent	Skills
vault-credential-generation	vault/credential-generation	"Generate credentials for my app"	secrets-engines, vault-agent
vault-app-access	vault/app-access	"Give my app access to Vault"	auth-methods, policies, token-management, identity-system, response-wrapping
vault-deployment	vault/deployment	"Deploy and operate Vault"	kubernetes-integration, production-operations, troubleshooting
vault-multi-tenancy	vault/multi-tenancy	"Set up multi-tenant Vault"	enterprise-features
vault-ai-workflows	vault/ai-workflows	"Let AI manage my secrets"	vault-mcp-server, mcp-secrets-workflows
vault-hashicorp-secrets-engines	vault/hashicorp-secrets-engines	"Generate tokens for HashiCorp products"	consul-secrets, nomad-secrets, terraform-cloud-secrets

Skills (16)

Plugin	Skill	Description
credential-generation	secrets-engines	KV secrets, database dynamic credentials, AWS/Azure/GCP credentials, Transit encryption, PKI certificates, SSH, TOTP
credential-generation	vault-agent	Auto-auth, caching, secret file templating, sidecar patterns
app-access	auth-methods	AppRole, Kubernetes, OIDC/JWT, AWS IAM, Azure, GCP, LDAP, GitHub auth
app-access	policies	ACL policies, capabilities, templated policies, path patterns, Sentinel (Enterprise)
app-access	token-management	Token types, periodic/batch tokens, accessors, orphan tokens, lifecycle
app-access	identity-system	Entities, aliases, groups, identity tokens, OIDC provider
app-access	response-wrapping	Cubbyhole secrets, secure distribution, wrapped tokens, bootstrap workflows
deployment	kubernetes-integration	Vault Secrets Operator (VSO), Agent Injector, CSI Provider, Kubernetes auth
deployment	production-operations	HA architecture, Integrated Storage (Raft), auto-unseal, DR replication, monitoring, backup/recovery
deployment	troubleshooting	Sealed Vault, permission denied, token expired, performance, audit log analysis
multi-tenancy	enterprise-features	Namespaces, Performance/DR replication, Sentinel, MFA, Control Groups, HSM
ai-workflows	vault-mcp-server	Install and configure Vault MCP Server for AI-assisted secrets management
ai-workflows	mcp-secrets-workflows	Managing secrets with Claude, KV mounts via MCP, automating Vault operations
hashicorp-secrets-engines	consul-secrets	Dynamic Consul ACL tokens through Vault
hashicorp-secrets-engines	nomad-secrets	Dynamic Nomad ACL tokens through Vault
hashicorp-secrets-engines	terraform-cloud-secrets	Dynamic Terraform Cloud/Enterprise API tokens through Vault

Skill Decision Framework Pattern

Every skill starts with a decision framework that routes users to the right solution:

## What Are You Trying to Solve?

### "I need my CI/CD pipeline to access Vault"
→ Use **AppRole** with response wrapping. [Jump to AppRole](#approle)

### "I need my Kubernetes pods to get secrets"
→ Use **Kubernetes auth**. [Jump to Kubernetes](#kubernetes)

Followed by:

• "How X Works" mental model section
• Decision tables mapping problems to solutions
• Detailed reference material

Changes Summary

• 49 files changed (46 added, 3 modified)
• 6 plugin directories with plugin.json (v0.2.0) and SPEC.md
• 16 SKILL.md files with decision frameworks
• 17 reference documents
• vault/README.md with installation instructions
• Updated: .claude-plugin/marketplace.json, CHANGELOG.md, README.md

Repository Totals After Merge

• 11 plugins (terraform: 3, packer: 2, vault: 6)
• 29 skills (terraform: 9, packer: 4, vault: 16)

[hashicorp-cla-app]

All committers have signed the CLA.

[gautambaghel]

@MrFixit96 - Thanks for the PR, will merge this week after getting the Tessl pipeline setup for feedback

Do you mind fixing the CI that's failing? it seems the repo structure has issues

[MrFixit96]

CI failure analysis summary for run https://github.com/hashicorp/agent-skills/actions/runs/23818076999/job/69422941930?pr=22

Root cause: this is a workflow script bug in .github/workflows/tessl-skill-review.yml, not a SKILL.md validation/content failure.

What happened:

• Tessl successfully reviewed the first changed skill (overallPassed: true, reviewScore: 74).
• The job then crashed with exit code 127:
  /home/runner/work/_temp/...sh: line 99: vault/ai-workflows/skills/mcp-secrets-workflows\: No such file or directory

Why it failed:

• In Run skill reviews, the table row is built with backticks:
  TABLE="${TABLE}\\n| \\${DIR_DISPLAY}\ | ..."
• Bash treats backticks as command substitution, so it attempts to execute the skill path as a command.

Suggested fix:

• Replace backtick-based formatting with a safe representation (for example <code>${DIR_DISPLAY}</code>), or build rows with printf to avoid command substitution.

Note: same failure signature appears in earlier failed Tessl runs, so this looks systemic to the workflow script.

[gautambaghel]

@MrFixit96 some minor changes requested

[github-actions]

Tessl Skill Review Results

Skill	Status	Review Score	Change
vault/ai-workflows/skills/mcp-secrets-workflows	✅ PASSED	96%
vault/ai-workflows/skills/vault-mcp-server	✅ PASSED	88%
vault/app-access/skills/auth-methods	✅ PASSED	88%
vault/app-access/skills/identity-system	✅ PASSED	83%
vault/app-access/skills/policies	✅ PASSED	92%
vault/app-access/skills/response-wrapping	✅ PASSED	83%
vault/app-access/skills/token-management	✅ PASSED	83%
vault/credential-generation/skills/secrets-engines	✅ PASSED	92%
vault/credential-generation/skills/vault-agent	✅ PASSED	88%
vault/deployment/skills/kubernetes-integration	✅ PASSED	88%
vault/deployment/skills/production-operations	✅ PASSED	88%
vault/deployment/skills/troubleshooting	✅ PASSED	83%
vault/hashicorp-secrets-engines/skills/consul-secrets	✅ PASSED	83%
vault/hashicorp-secrets-engines/skills/nomad-secrets	✅ PASSED	83%
vault/hashicorp-secrets-engines/skills/terraform-cloud-secrets	✅ PASSED	83%
vault/multi-tenancy/skills/enterprise-features	✅ PASSED	88%

---

Detailed Review

vault/ai-workflows/skills/mcp-secrets-workflows — 96% (PASSED)

  Description: 100%
    specificity: 3/3 - Lists multiple specific concrete actions: create mounts, read/write KV secrets, list existing secrets, rotate values, clean up deprecated paths. Also enumerates the specific tool names (create_mount, list_mounts, write_secret, read_secret, list_secrets, delete_secret, delete_mount).
    trigger_term_quality: 3/3 - Includes strong natural keywords users would say: 'secrets', 'mounts', 'KV secrets', 'rotate values', 'deprecated paths', 'Vault', 'read/write'. These cover common variations of how users would describe secrets management tasks.
    completeness: 3/3 - Clearly answers both 'what' (Vault MCP Server tools for secrets workflows, with enumerated operations) and 'when' (explicit 'Use when asked to create mounts, read/write KV secrets, list existing secrets, rotate values, or clean up deprecated paths').
    distinctiveness_conflict_risk: 3/3 - Highly distinctive with clear niche: Vault MCP Server, secrets management, specific tool names. Unlikely to conflict with other skills due to the specific domain (HashiCorp Vault secrets management) and enumerated operations.

    Assessment: This is a strong skill description that clearly identifies its domain (Vault MCP Server secrets management), lists specific concrete actions and tool names, and provides explicit trigger guidance via a 'Use when' clause. The description is concise yet comprehensive, covering both what the skill does and when it should be selected, with natural trigger terms that users would employ when requesting secrets management tasks.

  Content: 92%
    conciseness: 3/3 - The content is lean and well-structured. It avoids explaining what Vault is, what KV secrets are, or how MCP works—all things Claude already knows. Every section earns its place with actionable guidance, and the quick tool map is an efficient reference format.
    actionability: 2/3 - The skill provides clear tool names and sequences but lacks concrete executable examples—no actual tool call syntax with realistic parameters (e.g., full create_mount call with all arguments). The guidance is specific enough to follow but stops short of copy-paste ready invocations.
    workflow_clarity: 3/3 - Multi-step workflows are clearly sequenced with explicit verification steps (list after create, re-read after write). The destructive operations pattern includes a proper safety checklist with pre-delete verification, consumer confirmation, and explicit approval gates before proceeding.
    progressive_disclosure: 3/3 - The SKILL.md serves as a clear overview with well-signaled one-level-deep references to a detailed reference file and a related server setup skill. Content is appropriately split between the overview patterns here and full parameter tables in the referenced file.

    Assessment: This is a well-structured skill that efficiently maps user intents to tool sequences with clear workflows and strong safety guardrails for destructive operations. Its main weakness is the lack of concrete, executable tool call examples with realistic parameters—the guidance describes what to do but doesn't show exact invocation syntax. The progressive disclosure and workflow clarity are both strong.

Suggestions:

• Add at least one fully concrete tool call example per pattern (e.g., create_mount(type="kv2", path="myapp-prod")) to move from descriptive to executable guidance.
• Include a brief example of expected tool output or response format so Claude knows what success looks like when executing these workflows.

vault/ai-workflows/skills/vault-mcp-server — 88% (PASSED)

  Description: 100%
    specificity: 3/3 - Lists multiple specific concrete actions: install, configure, Docker setup, transport modes, environment variables, and security configuration. These are concrete, actionable capabilities.
    trigger_term_quality: 3/3 - Includes strong natural keywords users would say: 'Vault MCP Server', 'secrets management', 'MCP for Vault', 'Claude', 'VS Code', 'HashiCorp Vault', 'Docker setup', 'AI assistants'. Good coverage of terms across different user phrasings.
    completeness: 3/3 - Clearly answers both what ('Install and configure the Vault MCP Server for AI-assisted secrets management') and when ('Use when asked about setting up MCP for Vault, configuring Claude or VS Code to use Vault, or integrating AI assistants with HashiCorp Vault'). Explicit 'Use when' clause with specific triggers.
    distinctiveness_conflict_risk: 3/3 - Very distinct niche combining Vault + MCP Server + AI assistants. The specific mention of HashiCorp Vault, MCP, and the integration context makes it highly unlikely to conflict with generic infrastructure or secrets management skills.

    Assessment: This is a well-crafted skill description that hits all the key criteria. It provides specific capabilities, includes a clear 'Use when' clause with natural trigger terms, and occupies a distinct niche that minimizes conflict risk. The description is concise yet comprehensive, covering both the what and when effectively.

  Content: 75%
    conciseness: 2/3 - The skill is mostly efficient with good use of tables and code blocks, but includes some unnecessary sections like the 'What Are You Trying to Solve?' navigation block and the 'How Vault MCP Server Works' overview that explain things Claude can infer. The Transport Modes section repeats information already evident from the code examples.
    actionability: 3/3 - Provides fully executable Docker commands, complete JSON configuration files for VS Code, and specific bash commands for troubleshooting. All code examples are copy-paste ready with clear placeholder values.
    workflow_clarity: 2/3 - The overall flow from installation to configuration to usage is clear, but there are no explicit validation checkpoints. After running the Docker container, there's no step to verify the MCP server started correctly or that the connection to Vault succeeded before proceeding to client configuration.
    progressive_disclosure: 2/3 - References to 'references/vault-mcp-server.md' and '../mcp-secrets-workflows/SKILL.md' are well-signaled, but no bundle files are provided to verify these exist. The main file itself is quite long (~200 lines) with inline content like the full environment variables table and TLS configuration that could be in reference files.

    Assessment: This is a solid, actionable skill with excellent executable examples for Docker setup, VS Code configuration, and troubleshooting. Its main weaknesses are moderate verbosity (the navigation header and transport mode explanations add tokens without proportional value) and the lack of explicit validation steps after installation/configuration. The environment variables table and TLS/rate-limiting sections could be offloaded to the referenced detail file to improve progressive disclosure.

Suggestions:

• Add a validation step after the Quick Start Docker command (e.g., 'Verify connection: check server logs for successful Vault handshake') to improve workflow clarity.
• Move the full environment variables table, TLS configuration, and rate limiting sections to references/vault-mcp-server.md and keep only the most essential variables inline.
• Remove or condense the 'What Are You Trying to Solve?' and 'How Vault MCP Server Works' sections—Claude can infer the purpose from the skill description and the concrete examples.

vault/app-access/skills/auth-methods — 88% (PASSED)

  Description: 92%
    specificity: 2/3 - The description names the domain (Vault authentication methods) and mentions 'identity verification and token generation' as actions, but the core verb is just 'Configure' — it doesn't list multiple concrete actions like 'create AppRole roles, bind Kubernetes service accounts, configure OIDC callbacks'.
    trigger_term_quality: 3/3 - Excellent coverage of natural trigger terms: AppRole, Kubernetes auth, OIDC/JWT, AWS IAM auth, Azure auth, GCP auth, LDAP, GitHub auth, trusted broker pattern. These are the exact terms users would use when asking about Vault authentication configuration.
    completeness: 3/3 - Clearly answers both 'what' (configure Vault authentication methods, identity verification and token generation) and 'when' (explicit 'Use when asked about...' clause listing specific triggers).
    distinctiveness_conflict_risk: 3/3 - Highly distinctive — the combination of 'Vault' with specific auth method names (AppRole, Kubernetes auth, OIDC/JWT, AWS IAM, etc.) creates a clear niche that is unlikely to conflict with other skills.

    Assessment: This is a strong skill description with excellent trigger term coverage and a clear 'Use when' clause that explicitly lists numerous authentication methods. The main weakness is that the 'what' portion is somewhat thin — 'Configure' is a single high-level verb, and 'identity verification and token generation' is fairly general. Adding more specific actions (e.g., 'create auth method mounts, configure role bindings, set token policies') would strengthen specificity.

  Content: 83%
    conciseness: 2/3 - The skill is mostly efficient with good use of tables and code blocks, but includes some unnecessary framing ('What Are You Trying to Solve?' section is somewhat verbose) and the 'How Vault Authentication Works' section explains concepts Claude already knows. The selection guide table and best practices are tight, but overall could be trimmed.
    actionability: 3/3 - Provides fully executable vault CLI commands for each auth method (AppRole, Kubernetes, OIDC, AWS IAM), including enable, configure, create role, and login steps. The trusted broker pattern with response wrapping is concrete and copy-paste ready.
    workflow_clarity: 2/3 - Each auth method shows a clear sequence of steps (enable → configure → create role → login), but there are no validation checkpoints or error recovery steps. For security-sensitive operations like auth configuration, missing verification steps (e.g., 'test the login works', 'verify the policy attachment') is a notable gap.
    progressive_disclosure: 3/3 - Well-structured with a problem-oriented navigation at the top, a concise quick reference for the most common methods, and clear one-level-deep references to 'references/auth-methods.md' for detailed configurations of additional methods (Azure, GCP, LDAP, GitHub). The content split between overview and reference file is appropriate.

    Assessment: This is a well-organized skill with strong actionability through executable CLI commands and good progressive disclosure via problem-oriented navigation and external references. Its main weaknesses are some verbosity in the introductory sections and the absence of validation/verification steps after configuring auth methods, which is important for security-critical operations.

Suggestions:

• Expand the capability description beyond 'Configure' to list 2-3 more specific actions, e.g., 'mount auth backends, create and bind roles, set token TTLs and policies'.
• Add validation steps after each auth method configuration (e.g., 'vault auth list' to verify enablement, a test login command to confirm the setup works) to improve workflow clarity.
• Trim the 'What Are You Trying to Solve?' section to a compact table or bullet list rather than individual headings, and remove the 'How Vault Authentication Works' section since Claude already understands this flow.

vault/app-access/skills/identity-system — 83% (PASSED)

  Description: 92%
    specificity: 2/3 - The description names the domain (Vault identity) and lists several related concepts (entities, aliases, groups, identity tokens, OIDC provider configuration), but does not describe concrete actions like 'create entities', 'configure OIDC providers', or 'manage group memberships'. It reads more like a topic list than an action list.
    trigger_term_quality: 3/3 - Includes strong natural keywords a user would mention: 'Vault identity', 'entities', 'aliases', 'groups', 'identity tokens', 'OIDC', 'SSO'. These are the terms someone working with Vault identity would naturally use.
    completeness: 3/3 - The description explicitly answers both 'what' (covers unified identity management and SSO patterns including entities, aliases, groups, identity tokens, OIDC) and 'when' (starts with 'Use when working with Vault identity, entities, aliases, groups...'). The 'Use when' clause is explicit.
    distinctiveness_conflict_risk: 3/3 - The description is clearly scoped to Vault identity management specifically, with distinct triggers like 'entities', 'aliases', 'identity tokens', and 'OIDC provider configuration' that are unlikely to conflict with other Vault skills (e.g., secrets, auth methods, policies).

    Assessment: The description has strong trigger terms and clear 'when' guidance, making it effective for skill selection among multiple Vault-related skills. Its main weakness is the lack of specific concrete actions—it lists concepts/nouns rather than verbs describing what the skill actually does (e.g., create, configure, manage, troubleshoot). Adding action verbs would improve specificity.

  Content: 75%
    conciseness: 2/3 - The content is mostly efficient with good executable examples, but has notable redundancy: the Identity Hierarchy ASCII diagram appears twice identically, and some sections like 'Common Patterns' describe workflows at a high level that Claude could infer. The 'How Vault Identity Works' section and the problem-solution intro add some value but could be tighter.
    actionability: 3/3 - Nearly every section provides concrete, copy-paste-ready CLI commands and API curl examples. Entity creation, alias mapping, group management, OIDC configuration, token templates, lookups, and merges all have executable code. The troubleshooting table adds practical diagnostic guidance.
    workflow_clarity: 2/3 - The 'Common Patterns' section lists steps for SSO integration and cross-auth identity but lacks validation checkpoints or feedback loops. For operations like entity merging (which is destructive/irreversible), there's no verification step to confirm the merge succeeded or guidance on what to check before merging. Multi-step processes are listed but not validated.
    progressive_disclosure: 2/3 - The skill references 'references/identity-system.md' for advanced patterns, which is good, but no bundle files exist to support this reference. The problem-solution navigation at the top with jump links is well-structured, but the document itself is quite long (~180 lines of content) with sections like API Examples that could be offloaded to a reference file. The duplicate Identity Hierarchy diagram also suggests poor organization.

    Assessment: This is a solid reference skill with excellent actionability—nearly every concept is backed by executable CLI and API examples. However, it suffers from redundancy (duplicate diagram), missing validation steps for destructive operations like entity merging, and a length that would benefit from offloading API examples and advanced patterns to referenced files. The problem-oriented navigation at the top is a nice touch for discoverability.

Suggestions:

• Add concrete action verbs describing what the skill does, e.g., 'Creates and manages Vault identity entities, aliases, and groups. Configures OIDC providers and identity tokens.'
• Consider listing specific tasks like 'link auth method aliases to entities', 'set up external group mappings', or 'configure identity token templates' to improve specificity.
• Remove the duplicate Identity Hierarchy ASCII diagram (appears in both the overview and its own section).
• Add a verification step after entity merge (e.g., vault read identity/entity/id/entity-uuid-primary to confirm aliases were transferred) and before merge (e.g., list aliases on source entities).
• Move the API Examples and Lookup Operations sections to the referenced references/identity-system.md file to reduce the main skill's token footprint.
• Add a validation/verification step to the SSO Integration and Cross-Auth Method Identity patterns (e.g., 'Test by authenticating via each method and verifying vault token lookup shows the same entity ID').

vault/app-access/skills/policies — 92% (PASSED)

  Description: 100%
    specificity: 3/3 - Lists multiple specific concrete actions and concepts: writing HCL policies, ACL policies, policy syntax, specific capabilities (read, write, list, delete, sudo), templated policies, path patterns, Sentinel policies, and troubleshooting permission denied errors.
    trigger_term_quality: 3/3 - Excellent coverage of natural terms users would say: 'ACL policies', 'policy syntax', 'read, write, list, delete, sudo', 'templated policies', 'path patterns', 'Sentinel policies', 'permission denied errors', 'Vault', 'HCL'. These are all terms a user would naturally use when seeking help with Vault policies.
    completeness: 3/3 - Clearly answers both 'what' (write Vault HCL policies for access control) and 'when' (explicit 'Use when' clause listing specific trigger scenarios including ACL policies, capabilities, templated policies, Sentinel policies, and troubleshooting permission denied errors).
    distinctiveness_conflict_risk: 3/3 - Highly distinctive with a clear niche: HashiCorp Vault HCL policy writing. The specific mention of Vault, HCL, ACL policies, Sentinel (Enterprise), and permission denied errors makes it very unlikely to conflict with other skills.

    Assessment: This is an excellent skill description that clearly defines its scope (Vault HCL policies for access control), provides comprehensive trigger terms covering common user queries, and includes an explicit 'Use when' clause with diverse scenarios. It uses proper third-person voice and is concise yet thorough, making it easy for Claude to select this skill appropriately from a large pool.

  Content: 83%
    conciseness: 2/3 - The content is mostly efficient with good use of tables and code blocks, but includes some unnecessary sections like the 'How Vault Policies Work' overview and 'Best Practices' bullet points that largely state things Claude already knows (least privilege, test before production). The problem-oriented navigation at the top is useful but adds length.
    actionability: 3/3 - Provides fully executable HCL policy examples for every common pattern (application, operator, CI/CD, templated), plus concrete bash commands for policy management and debugging. All code is copy-paste ready with realistic paths and capabilities.
    workflow_clarity: 2/3 - The 'How Vault Policies Work' section provides a clear 4-step conceptual sequence, and debugging steps are listed. However, there's no explicit validation workflow (e.g., write policy → test capabilities → verify access → iterate), which is important for access control operations where mistakes can lock out users or expose secrets.
    progressive_disclosure: 3/3 - Well-structured with a problem-oriented navigation header, clear sections for quick reference vs. common patterns vs. debugging, and appropriate references to 'references/policies.md' for advanced topics like Sentinel policies. Content is appropriately split between overview and detailed reference.

    Assessment: This is a well-structured skill with excellent actionability — every pattern includes executable HCL and CLI commands. The problem-oriented navigation at the top is a strong design choice for discoverability. Main weaknesses are some verbosity in explanatory sections that Claude doesn't need, and the lack of an explicit validate-and-iterate workflow for policy creation/testing.

Suggestions:

• Add an explicit validation workflow: write policy → apply → test with vault token capabilities → verify expected behavior → iterate if wrong, to cap workflow_clarity at 3.
• Trim the 'How Vault Policies Work' section and 'Best Practices' to remove concepts Claude already knows (e.g., least privilege, test before production) to improve conciseness.

vault/app-access/skills/response-wrapping — 83% (PASSED)

  Description: 92%
    specificity: 2/3 - Names the domain (Vault response wrapping, cubbyhole secrets) and some actions (wrap/unwrap operations, malfeasance detection), but doesn't list multiple concrete step-by-step actions like 'create wrapped tokens, unwrap secrets, configure cubbyhole backends, detect token interception.'
    trigger_term_quality: 3/3 - Includes strong natural keywords users would say: 'Vault response wrapping', 'cubbyhole secrets', 'secure secret distribution', 'wrapped tokens', 'bootstrap workflows', 'wrap/unwrap operations', and 'malfeasance detection'. Good coverage of domain-specific terms.
    completeness: 3/3 - Explicitly answers both 'when' ('Use when working with Vault response wrapping, cubbyhole secrets, secure secret distribution, wrapped tokens, or bootstrap workflows') and 'what' ('Covers wrap/unwrap operations and malfeasance detection'). Has a clear 'Use when...' clause.
    distinctiveness_conflict_risk: 3/3 - Highly distinctive with niche triggers like 'cubbyhole secrets', 'response wrapping', 'wrapped tokens', and 'malfeasance detection' that are very specific to this Vault feature area and unlikely to conflict with other skills.

    Assessment: This is a solid description with excellent trigger terms and completeness, clearly specifying when to use the skill with a proper 'Use when...' clause. The main weakness is that the 'what it does' portion is somewhat thin—'Covers wrap/unwrap operations and malfeasance detection' could be expanded with more concrete actions. The distinctiveness is excellent given the niche Vault domain.

  Content: 75%
    conciseness: 2/3 - The content has significant duplication: the 'Secure Handoff Pattern' ASCII diagram appears twice, the TTL guidelines table appears twice with nearly identical content, and the wrapping flow explanation is repeated in both the overview and detailed sections. Some sections like 'How Response Wrapping Works' and the problem-oriented intro add useful framing but could be tighter.
    actionability: 3/3 - The skill provides fully executable CLI commands and curl API examples for every operation: wrapping, unwrapping, cubbyhole read/write, bootstrap workflow, rewrapping, and token creation. Commands include realistic output examples and are copy-paste ready.
    workflow_clarity: 2/3 - The bootstrap workflow has a clear numbered sequence, but lacks explicit validation checkpoints. For a security-sensitive operation like secret distribution, there's no step to verify the unwrap succeeded, no error handling guidance in the workflow itself, and the malfeasance detection section describes the concept but doesn't integrate it as a verification step in the bootstrap workflow.
    progressive_disclosure: 2/3 - The skill references 'references/response-wrapping.md' for complete workflows, which is good progressive disclosure, but no bundle files exist to support this reference. The content itself is somewhat monolithic—the problem-oriented intro, conceptual overview, and detailed reference material are all inline rather than appropriately split. The jump-link navigation at the top is a nice touch but the document is long enough that some content should be in referenced files.

    Assessment: The skill provides strong actionable content with executable CLI and API examples covering all key response wrapping operations. However, it suffers from notable duplication (diagram and TTL table repeated), lacks validation checkpoints in its security-sensitive workflows, and references a bundle file that doesn't exist. Trimming duplicates and integrating malfeasance detection as an explicit verification step in workflows would significantly improve quality.

Suggestions:

• Expand the capabilities section with more specific concrete actions, e.g., 'Creates wrapped secret tokens, unwraps responses, configures cubbyhole secret engines, detects token interception or misuse' instead of the generic 'Covers wrap/unwrap operations.'
• Remove the duplicated 'Secure Handoff Pattern' diagram and 'Wrapping TTL' table—keep them in one location only.
• Add an explicit verification/validation step in the Bootstrap Workflow (e.g., 'Step 3b: If unwrap fails, trigger malfeasance detection and regenerate credentials').
• Either provide the referenced 'references/response-wrapping.md' bundle file or remove the reference to avoid broken navigation.
• Move the detailed API examples and troubleshooting table into a separate reference file to reduce the main skill's length and improve progressive disclosure.

vault/app-access/skills/token-management — 83% (PASSED)

  Description: 92%
    specificity: 2/3 - The description names the domain (Vault tokens) and mentions several concepts like periodic tokens, batch tokens, token accessors, orphan tokens, and token lifecycle, but these read more as topic areas than concrete actions. Only 'creating' and 'managing' are action verbs, and they're fairly generic.
    trigger_term_quality: 3/3 - Includes strong natural keywords a user would use: 'Vault token', 'periodic tokens', 'batch tokens', 'token accessors', 'orphan tokens', 'token lifecycle', 'service vs batch tokens', 'renewal strategies'. These are terms users working with HashiCorp Vault would naturally mention.
    completeness: 3/3 - The description explicitly answers both 'what' (covers service vs batch tokens, renewal strategies, token lifecycle management) and 'when' with a clear 'Use when...' clause listing specific trigger scenarios like working with token types, creating periodic/batch tokens, and managing accessors.
    distinctiveness_conflict_risk: 3/3 - The description is highly specific to HashiCorp Vault token management with distinct terminology (token accessors, orphan tokens, service vs batch tokens) that is unlikely to conflict with other skills. This is a clear, narrow niche.

    Assessment: This is a solid skill description with excellent trigger term coverage and clear 'Use when' guidance specific to Vault token management. Its main weakness is that the capabilities are described more as topic areas ('covers service vs batch tokens') rather than concrete actions (e.g., 'create periodic tokens, revoke tokens, look up token accessors'). Overall it would perform well in skill selection due to its distinctive terminology and explicit trigger clause.

  Content: 75%
    conciseness: 2/3 - The skill is mostly efficient with good use of tables and code blocks, but there's some redundancy—the decision matrix at the bottom largely duplicates the token type selection table near the top, and the 'How Vault Tokens Work' section explains concepts Claude already knows. The problem-oriented navigation at the top is nice but adds tokens for what could be a simpler structure.
    actionability: 3/3 - Every token type section includes concrete, executable bash commands that are copy-paste ready. The API examples with curl, the Go renewal snippet, and the token store role creation commands are all specific and actionable.
    workflow_clarity: 2/3 - The token lifecycle is described at a high level, and individual operations are clear, but there are no explicit validation checkpoints or feedback loops for token renewal workflows. For a skill covering token lifecycle management—where failing to renew before TTL is destructive—the absence of a validate-then-act pattern (e.g., check remaining TTL before renewal, verify renewal succeeded) caps this at 2.
    progressive_disclosure: 2/3 - The skill references 'references/token-management.md' for complete lifecycle patterns and accessor management, but no bundle file exists to support this reference. The content is reasonably structured with sections and a problem-oriented index, but the document is quite long (~200 lines of substantive content) with sections like API examples and troubleshooting that could be split into reference files.

    Assessment: This is a solid, actionable skill with excellent concrete examples covering all major Vault token types and operations. Its main weaknesses are some content redundancy (duplicate decision tables), missing validation/feedback loops in renewal workflows, and a monolithic structure that would benefit from splitting API examples and troubleshooting into separate reference files. The referenced bundle file doesn't exist, undermining the progressive disclosure strategy.

Suggestions:

• Replace topic-oriented phrasing like 'Covers service vs batch tokens' with concrete action verbs such as 'Creates periodic and batch tokens, revokes tokens, looks up token accessors, manages token renewal and lifecycle.'
• Remove the duplicate decision matrix at the bottom since the 'Token Type Selection' table near the top already covers the same information.
• Add explicit validation steps to the renewal workflow, e.g., 'vault token lookup' to check remaining TTL before renewal, and verify renewal succeeded by checking the new TTL.
• Move API examples and troubleshooting into the referenced 'references/token-management.md' file (which is already referenced but doesn't exist) to reduce the main skill's length and improve progressive disclosure.

vault/credential-generation/skills/secrets-engines — 92% (PASSED)

  Description: 100%
    specificity: 3/3 - Lists multiple specific concrete actions and capabilities: KV secrets, database dynamic credentials, cloud provider credentials (AWS/Azure/GCP), Transit encryption, PKI certificates, SSH secrets, TOTP, static secrets, dynamic credentials, encryption-as-a-service, and secrets engine lifecycle.
    trigger_term_quality: 3/3 - Excellent coverage of natural trigger terms users would say: 'KV secrets', 'database dynamic credentials', 'AWS/Azure/GCP credentials', 'Transit encryption', 'PKI certificates', 'SSH secrets', 'TOTP', 'secrets engine'. These are the exact terms practitioners use when working with Vault.
    completeness: 3/3 - Clearly answers both 'what' (configure and use Vault secrets engines, covering static secrets, dynamic credentials, encryption-as-a-service, lifecycle) and 'when' (explicit 'Use when asked about...' clause with specific trigger scenarios).
    distinctiveness_conflict_risk: 3/3 - Highly distinctive with a clear niche around HashiCorp Vault secrets engines specifically. The combination of Vault-specific terminology (KV, Transit, PKI, secrets engines) makes it very unlikely to conflict with other skills.

    Assessment: This is a strong skill description that clearly defines its scope around Vault secrets engines with specific capabilities and explicit trigger guidance. It uses proper third-person voice, includes comprehensive natural trigger terms that practitioners would use, and has a clear 'Use when' clause. The description is concise yet thorough, covering both the breadth of secrets engine types and the categories of functionality.

  Content: 83%
    conciseness: 2/3 - The skill is mostly efficient with good use of tables and code blocks, but the 'What Are You Trying to Solve?' section is somewhat verbose for Claude (who doesn't need conversational problem-framing), and the 'How Secrets Engines Work' overview explains concepts Claude likely already knows. The best practices section also contains fairly obvious advice.
    actionability: 3/3 - All major secrets engines have concrete, executable bash commands that are copy-paste ready. The database example includes full connection configuration, role creation with SQL statements, and credential retrieval. Transit shows the full encrypt/decrypt cycle including base64 encoding.
    workflow_clarity: 2/3 - The 'How Secrets Engines Work' section provides a clear 5-step sequence (mount → configure → create roles → read → renew/revoke), and individual engine sections follow this pattern. However, there are no validation checkpoints or error recovery steps — e.g., no guidance on verifying a database connection works before creating roles, or checking that PKI root CA was generated correctly before issuing certs.
    progressive_disclosure: 3/3 - The skill provides a clear overview with quick-reference commands inline and appropriately defers detailed configuration to references/secrets-engines.md. The jump-links at the top serve as effective navigation. References are one level deep and clearly signaled.

    Assessment: This is a well-structured skill that covers a broad topic with good actionability — concrete, executable commands for each secrets engine type. Its main weaknesses are the lack of validation/error-recovery steps in multi-step workflows (especially for database and PKI configuration which are fragile operations) and some unnecessary verbosity in the problem-framing introduction and best practices sections that explain things Claude already knows.

Suggestions:

• Add validation checkpoints after key steps — e.g., verify database connection with 'vault read database/config/postgres' before creating roles, and test credential generation before deploying to applications.
• Trim the 'What Are You Trying to Solve?' section to a compact table or decision tree rather than conversational Q&A format, and remove the 'Best Practices' bullet points that state obvious guidance (e.g., 'use dynamic secrets over static KV when possible').

vault/credential-generation/skills/vault-agent — 88% (PASSED)

  Description: 100%
    specificity: 3/3 - Lists multiple specific concrete actions: 'automatic authentication', 'caching', and 'secret templating'. These are distinct, well-defined capabilities of Vault Agent configuration.
    trigger_term_quality: 3/3 - Includes strong natural trigger terms users would actually say: 'sidecar patterns', 'auto-auth', 'token caching', 'secret file templating', 'integrating applications with Vault without SDK changes'. These cover multiple natural ways users would phrase their needs.
    completeness: 3/3 - Clearly answers both 'what' (configure Vault Agent for automatic authentication, caching, and secret templating) and 'when' (explicit 'Use when...' clause listing five specific trigger scenarios).
    distinctiveness_conflict_risk: 3/3 - Highly distinctive — targets a specific tool (Vault Agent) with specific patterns (sidecar, auto-auth, token caching, templating). Unlikely to conflict with general Vault skills or other infrastructure skills due to the precise scope.

    Assessment: This is an excellent skill description that clearly defines the scope (Vault Agent configuration), lists concrete capabilities (authentication, caching, templating), and provides explicit trigger guidance with natural terms users would use. It follows third-person voice and is concise without being vague.

  Content: 75%
    conciseness: 2/3 - The problem-solution navigation at the top is useful but somewhat verbose. The 'How Vault Agent Works' section explains concepts Claude likely already knows. The feature selection table adds value but the overall content could be tightened—the 'What Are You Trying to Solve?' section is a nice pattern but takes many tokens for what amounts to a table of contents.
    actionability: 3/3 - Provides fully executable HCL configurations, YAML pod specs, and template syntax examples that are copy-paste ready. Multiple auth methods are shown with concrete config blocks, and the template example includes realistic secret paths and rendering syntax.
    workflow_clarity: 2/3 - The 'How Vault Agent Works' section provides a clear 4-step sequence of how the agent operates, but there are no validation checkpoints or error recovery steps. For example, there's no guidance on verifying the agent authenticated successfully, checking template rendering output, or troubleshooting common failures like permission denied or misconfigured roles.
    progressive_disclosure: 2/3 - References to 'references/vault-agent.md' are clearly signaled and one level deep, which is good. However, no bundle files were provided, so the referenced file doesn't actually exist. The main SKILL.md also includes substantial inline content (all the common patterns, multiple auth methods) that could arguably be split into the reference file, making the overview leaner.

    Assessment: This is a solid, actionable skill with excellent concrete examples covering multiple Vault Agent patterns (K8s sidecar, auto-auth methods, caching, templating). Its main weaknesses are the lack of validation/troubleshooting steps in the workflow and some verbosity in the introductory sections. The progressive disclosure structure references a file that doesn't exist in the bundle, and the main file could be leaner by moving detailed patterns to the reference.

Suggestions:

• Add validation checkpoints: how to verify agent authenticated successfully (check sink file, agent logs), how to verify templates rendered correctly, and common error patterns with fixes.
• Move the detailed auto-auth method configurations and Kubernetes sidecar YAML into the referenced vault-agent.md file, keeping only the most common pattern (e.g., Kubernetes) inline.
• Trim the 'What Are You Trying to Solve?' section to a compact table mapping problems to features/anchors, and remove the 'How Vault Agent Works' explanatory section or reduce it to a single sentence since Claude understands proxy/sidecar patterns.

vault/deployment/skills/kubernetes-integration — 88% (PASSED)

  Description: 92%
    specificity: 2/3 - The description names the domain ('Integrate Vault with Kubernetes') and lists specific technologies (VSO, Agent Injector, CSI Provider, Kubernetes auth), but doesn't describe concrete actions beyond 'integrate' and 'syncing secrets'. It lacks detail on what specific operations are performed (e.g., configure, deploy, troubleshoot).
    trigger_term_quality: 3/3 - Excellent coverage of natural trigger terms users would use: 'Vault Secrets Operator', 'VSO', 'Agent Injector', 'CSI Provider', 'Kubernetes auth', 'syncing secrets to Kubernetes', 'pod-level secret injection'. These are the exact terms a user working in this space would naturally mention.
    completeness: 3/3 - Clearly answers both 'what' (integrate Vault with Kubernetes) and 'when' (explicit 'Use when' clause listing specific trigger scenarios like VSO, Agent Injector, CSI Provider, Kubernetes auth, syncing secrets, and pod-level injection patterns).
    distinctiveness_conflict_risk: 3/3 - Highly distinctive niche combining Vault + Kubernetes integration with very specific trigger terms (VSO, Agent Injector, CSI Provider). Unlikely to conflict with a general Vault skill or a general Kubernetes skill due to the intersection focus and specific technology names.

    Assessment: This is a strong skill description with excellent trigger term coverage and completeness. The explicit 'Use when' clause with specific technology names makes it highly discoverable and distinctive. The main weakness is that the 'what' portion could be more specific about concrete actions (e.g., configure, deploy, troubleshoot) rather than the broad verb 'integrate'.

  Content: 83%
    conciseness: 2/3 - The content is mostly efficient with good use of YAML/bash examples, but the decision-tree opening section and the best practices section repeat information already conveyed in the comparison table. The 'How Kubernetes Integration Works' section is somewhat obvious for Claude.
    actionability: 3/3 - Provides fully executable helm commands, complete YAML manifests for all three integration methods (VSO, Agent Injector, CSI Provider), and concrete annotation examples. All code is copy-paste ready with realistic values.
    workflow_clarity: 2/3 - The high-level 4-step workflow is listed but lacks validation checkpoints — there's no guidance on verifying that Kubernetes auth is configured correctly, that VSO is running, or that secrets are actually synced. For operations involving secret management, missing verification steps is a notable gap.
    progressive_disclosure: 3/3 - Well-structured with a decision-tree overview at the top, comparison table for quick reference, jump links to each method section, and clear references to references/kubernetes.md for advanced topics like RBAC, multi-cluster, and troubleshooting. Content is appropriately split between overview and detail.

    Assessment: This is a well-structured, highly actionable skill that provides concrete, executable examples for all three Vault-Kubernetes integration methods. Its main weaknesses are some redundancy between the decision tree, comparison table, and best practices section, and the lack of validation/verification steps in the workflow (e.g., how to confirm auth is working, secrets are syncing). The progressive disclosure is excellent with clear navigation and appropriate delegation to reference files.

Suggestions:

• Expand the 'what' clause with more specific actions, e.g., 'Configure and troubleshoot Vault integration with Kubernetes, including setting up auth methods, deploying operators, and managing secret synchronization.'
• Add validation checkpoints after key steps, e.g., 'kubectl get vaultstaticsecret' to verify sync status, 'vault read auth/kubernetes/config' to confirm auth setup, or checking pod logs for injection errors.
• Remove the 'Best Practices' section since it entirely duplicates the comparison table's 'Best for' row and the quick decision guidance already provided above it.

vault/deployment/skills/production-operations — 88% (PASSED)

  Description: 100%
    specificity: 3/3 - Lists multiple specific concrete actions and concepts: HA architecture, Integrated Storage (Raft), auto-unseal, DR replication, monitoring, metrics, backup/recovery, upgrades, and Enterprise features like namespaces and Sentinel.
    trigger_term_quality: 3/3 - Excellent coverage of natural terms users would say when needing production Vault help: 'HA architecture', 'Raft', 'auto-unseal', 'DR replication', 'monitoring', 'metrics', 'backup/recovery', 'upgrades', 'namespaces', 'Sentinel'. These are all terms a user would naturally use.
    completeness: 3/3 - Clearly answers both 'what' (deploy and operate Vault in production) and 'when' with an explicit 'Use when asked about...' clause listing specific trigger scenarios.
    distinctiveness_conflict_risk: 3/3 - Highly distinctive with a clear niche around production Vault operations. The specific terms like 'Raft', 'auto-unseal', 'DR replication', 'Sentinel', and 'namespaces' are unique to this domain and unlikely to conflict with other skills.

    Assessment: This is a strong skill description that clearly defines its scope (production Vault operations), provides an explicit 'Use when' clause with comprehensive trigger terms, and covers a well-defined niche. The description is concise yet thorough, listing specific capabilities and technologies that make it easy for Claude to select this skill appropriately.

  Content: 75%
    conciseness: 2/3 - The skill is reasonably efficient but includes some unnecessary elements: the 'What Are You Trying to Solve?' section is a navigation aid that adds bulk, the 'How Production Vault Works' section explains concepts Claude already knows, and the architecture diagram, while nice, consumes significant tokens for information that's fairly standard. The best practices section is also somewhat generic.
    actionability: 3/3 - The skill provides fully executable HCL configurations, bash commands, Prometheus scrape configs, and cron entries that are copy-paste ready. Specific examples cover Raft storage setup, auto-unseal for AWS and Azure, cluster operations, monitoring, and backup procedures.
    workflow_clarity: 2/3 - The Recovery Procedure has a clear 5-step sequence, but it lacks explicit validation checkpoints (e.g., verifying snapshot integrity before restore, confirming leader election after restart). The backup workflow is straightforward but doesn't include verification that snapshots are valid. For destructive operations like snapshot restore and node removal, there are no feedback loops or error recovery steps.
    progressive_disclosure: 2/3 - The skill references two external files (references/production-operations.md and references/enterprise.md) which is good structure, but no bundle files were provided, so those references are broken. The main file itself is quite long with inline content (monitoring, enterprise features, backup) that could be better distributed to the referenced files it already points to.

    Assessment: This is a solid operational reference skill with excellent actionability—concrete HCL configs, bash commands, and monitoring setup are all copy-paste ready. However, it's somewhat verbose with navigational scaffolding and explanatory sections that don't add much for Claude, and the workflow for critical operations like disaster recovery lacks explicit validation checkpoints. The progressive disclosure structure is partially implemented but undermined by missing bundle files and too much inline content.

Suggestions:

• Add explicit validation checkpoints to the Recovery Procedure (e.g., 'vault operator raft list-peers' after join, verify snapshot integrity before restore) to prevent silent failures in destructive operations.
• Move the detailed monitoring config, enterprise features table, and backup procedures into the referenced files (references/production-operations.md, references/enterprise.md) and keep only quick-reference summaries in the main SKILL.md.
• Remove or condense the 'How Production Vault Works' numbered list and the 'What Are You Trying to Solve?' section—Claude doesn't need these navigational aids and they consume tokens without adding actionable content.

vault/deployment/skills/troubleshooting — 83% (PASSED)

  Description: 92%
    specificity: 2/3 - The description names the domain (Vault) and mentions 'diagnose and resolve' as actions, but doesn't list specific concrete actions like 'unseal Vault', 'rotate tokens', or 'configure audit backends'. The listed items are more problem categories than specific actions the skill performs.
    trigger_term_quality: 3/3 - Excellent coverage of natural trigger terms users would actually say: 'Vault errors', 'sealed Vault', 'permission denied', 'token expired', 'performance problems', 'connection issues', 'audit log analysis'. These are realistic phrases a user troubleshooting Vault would use.
    completeness: 3/3 - Clearly answers both 'what' (diagnose and resolve Vault issues) and 'when' with an explicit 'Use when...' clause listing multiple specific trigger scenarios including errors, sealed state, permissions, tokens, performance, connections, and audit logs.
    distinctiveness_conflict_risk: 3/3 - HashiCorp Vault is a specific enough domain that this skill is unlikely to conflict with other skills. The trigger terms like 'sealed Vault', 'token expired', and 'audit log analysis' are distinctly Vault-related and create a clear niche.

    Assessment: This is a solid skill description with strong trigger terms and completeness. The explicit 'Use when...' clause with multiple natural trigger scenarios makes it easy for Claude to select appropriately. The main weakness is that the 'what' portion could be more specific about the concrete actions the skill performs beyond the generic 'diagnose and resolve'.

  Content: 75%
    conciseness: 2/3 - The skill is mostly efficient with good use of executable commands, but there's some redundancy — the 'What Error Are You Seeing?' section and the 'Common Issues' section cover the same topics, and the 'Best Practices for Troubleshooting' section largely restates the diagnostic workflow. The 'Quick Diagnostics' section also overlaps with commands shown in the Common Issues section.
    actionability: 3/3 - The skill provides fully executable bash commands and HCL snippets throughout. Every issue has concrete diagnostic commands and solutions that are copy-paste ready, including specific jq filters for audit log analysis and exact CLI commands for each troubleshooting scenario.
    workflow_clarity: 2/3 - The diagnostic workflow at the top provides a clear 5-step sequence, and individual issue sections have numbered diagnostic steps. However, there are no explicit validation checkpoints or feedback loops — for example, after unsealing there's no 'verify with vault status' step, and after fixing permission issues there's no 'test access again' verification step.
    progressive_disclosure: 2/3 - The skill references 'references/troubleshooting.md' for detailed content, which is good progressive disclosure structure. However, no bundle files are provided, so the reference is unverifiable. The main file itself is quite long (~180 lines) with content that could be split into separate reference files (e.g., performance troubleshooting, audit log analysis), and the quick-lookup table at the top is a nice touch but the overall document is somewhat monolithic.

    Assessment: This is a solid troubleshooting skill with excellent actionability — nearly every section has concrete, executable commands. The main weaknesses are redundancy between sections (the error lookup table, quick diagnostics, and common issues overlap significantly) and missing validation/feedback loops in the workflows. The progressive disclosure structure references an external file but the main document itself could benefit from being trimmed with more content pushed to references.

Suggestions:

• Expand the capability description with more specific actions, e.g., 'Diagnose and resolve Vault issues including unsealing procedures, token rotation, policy debugging, and secret engine configuration.'
• Remove redundancy by consolidating the 'What Error Are You Seeing?' quick-lookup, 'Quick Diagnostics', and 'Common Issues' sections — the quick-lookup can link directly to the detailed sections without repeating diagnostic commands.
• Add explicit verification steps after each fix (e.g., 'After unsealing, confirm with vault status -format=json | jq '.sealed'') to create proper feedback loops.
• Move detailed sections like Performance Issues and Audit Log Analysis into the referenced troubleshooting.md file to keep SKILL.md as a concise overview with the most common issues.

vault/hashicorp-secrets-engines/skills/consul-secrets — 83% (PASSED)

  Description: 92%
    specificity: 2/3 - Names the domain (Consul ACL tokens via Vault, Consul secrets engine) and some actions (generating tokens, configuring engine, managing credentials), but doesn't list multiple concrete granular actions like creating policies, binding service identities, or revoking tokens.
    trigger_term_quality: 3/3 - Includes strong natural keywords users would say: 'Consul ACL tokens', 'Vault', 'Consul secrets engine', 'Consul credentials', 'policies', 'service identities', 'node identities'. These are the terms someone working with this integration would naturally use.
    completeness: 3/3 - Explicitly answers both 'what' (generating dynamic Consul ACL tokens through Vault, configuring the Consul secrets engine, managing Consul credentials, policies, service/node identities) and 'when' (starts with 'Use when...' clause with clear trigger scenarios).
    distinctiveness_conflict_risk: 3/3 - Highly distinctive niche combining Vault + Consul ACL integration. The specific mention of 'Consul secrets engine', 'service identities', and 'node identities' makes it very unlikely to conflict with generic Vault or Consul skills.

    Assessment: This is a well-crafted description that clearly identifies its niche at the intersection of Vault and Consul ACL management. It leads with an explicit 'Use when...' clause and includes domain-specific trigger terms that users would naturally employ. The main weakness is that the specific actions could be slightly more granular (e.g., listing create/revoke/renew operations).

  Content: 75%
    conciseness: 2/3 - The content is mostly efficient with good use of tables and code blocks, but includes some unnecessary elements like the ASCII integration diagram, the 'What Are You Trying to Solve?' section which is somewhat verbose for Claude, and the API examples section which largely duplicates the CLI examples. The troubleshooting table and policy examples add bulk that could be in a reference file.
    actionability: 3/3 - Excellent actionability with fully executable bash commands throughout, concrete examples for every role type, credential generation with expected output shown, and specific HCL policy examples. Commands are copy-paste ready with realistic values.
    workflow_clarity: 2/3 - The high-level 4-step workflow (Configure → Create roles → Generate credentials → Automatic revocation) is clear, and the document follows a logical sequence. However, there are no validation checkpoints—no steps to verify the engine was enabled correctly, no verification that the Consul connection works after configuration, and no feedback loop for error recovery during setup.
    progressive_disclosure: 2/3 - The skill references 'references/consul-secrets.md' for complete role configuration and Enterprise features, which is good, but no bundle file exists to support this reference. The main file itself is quite long (~200 lines) with policy examples, API examples, and troubleshooting that could be split into reference files. The jump-link navigation at the top is a nice touch but the content itself is somewhat monolithic.

    Assessment: This is a well-structured skill with strong actionability—every configuration type has executable, copy-paste-ready commands with realistic examples. The main weaknesses are the lack of validation checkpoints in the workflow (e.g., verifying Consul connectivity after setup), some verbosity that could be trimmed (the problem-solution intro, ASCII diagram, duplicated CLI/API examples), and a referenced bundle file that doesn't exist. The content would benefit from being split into a concise SKILL.md with detailed references.

Suggestions:

• Add validation checkpoints after key steps: verify engine is enabled (vault secrets list), verify Consul connectivity (vault read consul/config/access), and verify generated tokens work before proceeding.
• Move policy examples, API examples, and troubleshooting into a referenced file (e.g., references/consul-secrets.md) to reduce the main skill's token footprint.
• Remove or significantly condense the 'What Are You Trying to Solve?' section—Claude can infer use cases from the role type selection table, which already covers the same information more concisely.

vault/hashicorp-secrets-engines/skills/nomad-secrets — 83% (PASSED)

  Description: 92%
    specificity: 2/3 - Names the domain (Vault/Nomad integration) and some actions like 'generating dynamic Nomad ACL tokens', 'configuring the Nomad secrets engine', 'role mapping and credential generation', but the actions are somewhat high-level and could be more concrete (e.g., listing specific commands or configuration steps).
    trigger_term_quality: 3/3 - Includes strong natural keywords users would actually say: 'Nomad ACL tokens', 'Vault', 'Nomad secrets engine', 'role mapping', 'credential generation', 'Nomad job scheduling'. These are the terms someone working with this integration would naturally use.
    completeness: 3/3 - Explicitly answers both 'what' (generating dynamic Nomad ACL tokens, configuring the Nomad secrets engine, role mapping, credential generation) and 'when' (starts with 'Use when...' clause with clear trigger scenarios like integrating Vault with Nomad job scheduling).
    distinctiveness_conflict_risk: 3/3 - Very specific niche combining Vault and Nomad ACL token generation, secrets engine configuration, and job scheduling integration. Unlikely to conflict with other skills given the highly specific technology pairing.

    Assessment: This is a well-structured skill description that clearly identifies its niche at the intersection of Vault and Nomad. It opens with an explicit 'Use when...' clause and includes relevant trigger terms. The main area for improvement is slightly more concrete action specificity—listing specific operations like 'create Nomad roles in Vault' or 'configure lease TTLs' would strengthen it further.

  Content: 75%
    conciseness: 2/3 - The skill is mostly efficient with good use of tables and code blocks, but it's quite long with some redundancy (e.g., global tokens explained in both Role Configuration and Multi-Region sections, token type covered in both the table and a separate section). The problem-oriented intro is useful but adds length. The API examples section largely duplicates the CLI examples in curl form, which is information Claude can derive.
    actionability: 3/3 - Excellent actionability throughout — every section provides concrete, copy-paste-ready bash commands, HCL policy files, and YAML CI/CD configurations. The credential generation example even shows expected output format, and the usage section demonstrates the full workflow from token generation to job submission.
    workflow_clarity: 2/3 - The high-level 4-step flow at the top is clear, and the document follows a logical setup → configure → use sequence. However, there are no explicit validation checkpoints (e.g., verifying the engine is enabled, confirming the access config works before creating roles, or validating that policies exist in Nomad before mapping them in Vault roles). The troubleshooting table partially compensates but doesn't constitute inline validation steps.
    progressive_disclosure: 2/3 - There is a reference to 'references/nomad-secrets.md' for complete role configuration details, but no bundle file exists to support it. The document itself is quite long (~200+ lines) with sections like API Examples, CI/CD Integration, and detailed policy examples that could be split into reference files. The problem-oriented navigation at the top with jump links is a nice touch for discoverability.

    Assessment: This is a solid, highly actionable skill with excellent concrete examples covering the full lifecycle of Nomad secrets engine usage. Its main weaknesses are length (several sections could be offloaded to reference files) and the lack of explicit validation checkpoints in the workflow, which is important when configuring secrets engines where misconfigurations can silently fail. The problem-oriented intro and troubleshooting table are strong additions.

Suggestions:

• Add explicit validation steps after key operations (e.g., 'vault read nomad/config/access' after configuring access, 'nomad acl policy list' before mapping policies to roles) to catch misconfigurations early.
• Move the API Examples, CI/CD Integration, and detailed Nomad Policy Examples sections into separate reference files to reduce the main skill's token footprint, and link to them from the main document.
• Ensure the referenced 'references/nomad-secrets.md' file actually exists in the bundle, or remove the reference if it doesn't exist.

vault/hashicorp-secrets-engines/skills/terraform-cloud-secrets — 83% (PASSED)

  Description: 92%
    specificity: 2/3 - Names the domain (Terraform Cloud/Enterprise API tokens through Vault) and mentions some actions (generating, rotation, lease management), but doesn't list comprehensive concrete actions like configuring backends, revoking tokens, or setting TTLs.
    trigger_term_quality: 3/3 - Includes strong natural keywords users would say: 'Terraform Cloud', 'Enterprise', 'API tokens', 'Vault', 'organization token', 'team token', 'user token', 'rotation', 'lease management'. These cover the key terms a user working in this space would naturally use.
    completeness: 3/3 - Explicitly answers both 'what' (generating dynamic Terraform Cloud/Enterprise API tokens through Vault, covering org/team/user token types with rotation and lease management) and 'when' (starts with 'Use when generating dynamic Terraform Cloud or Enterprise API tokens through Vault').
    distinctiveness_conflict_risk: 3/3 - Very specific niche combining Vault + Terraform Cloud/Enterprise API token generation. This is unlikely to conflict with general Terraform skills, general Vault skills, or other token management skills due to the precise intersection of technologies.

    Assessment: This is a well-crafted description for a narrow, specialized skill. It clearly states when to use it and covers the domain with relevant trigger terms. The main weakness is that the specific actions could be more granular—listing concrete operations like configuring secrets engines, setting TTLs, or revoking leases would strengthen the specificity.

  Content: 75%
    conciseness: 2/3 - The skill is mostly efficient with good use of tables and code blocks, but there's notable redundancy: the token comparison table appears twice (Token Type Selection and Token Comparison), and sections like CI/CD Integration, API Examples, and Use the Token add significant length. Some content like the GitHub Actions/GitLab CI examples and curl API examples could be trimmed or moved to a reference file.
    actionability: 3/3 - Excellent actionability throughout—every section provides copy-paste ready bash commands, complete with realistic placeholder values. The code examples cover setup, role creation, credential generation, usage patterns (env var, HCL config, API calls), CI/CD integration, and lease management, all with executable commands.
    workflow_clarity: 2/3 - The high-level 4-step workflow (Configure → Create roles → Generate credentials → Automatic expiry) is clear, and the decision tree at the top is helpful. However, there are no explicit validation checkpoints—after configuring the engine or creating roles, there's no 'verify the configuration works' step, and no error recovery feedback loops for the setup process.
    progressive_disclosure: 2/3 - The skill references a bundle file (references/terraform-cloud-secrets.md) for complete token types and workspace patterns, which is good. However, no bundle files were provided, and the main file is quite long (~200+ lines) with sections like CI/CD Integration, API Examples, and detailed troubleshooting that could be split into reference files. The decision tree at the top is excellent for navigation though.

    Assessment: This is a well-structured, highly actionable skill with excellent decision-tree navigation and comprehensive executable examples. Its main weaknesses are redundancy (duplicate comparison tables), length that could benefit from more aggressive splitting into reference files, and missing validation/verification steps in the setup workflow. The content would benefit from trimming repetitive sections and adding explicit verification checkpoints.

Suggestions:

• Add more concrete actions beyond 'generating' and 'rotation', such as 'configure Vault Terraform secrets engine, generate and revoke tokens, set TTLs and max TTLs'.
• Remove the duplicate token comparison table (keep one, preferably the more detailed 'Token Comparison' version) and consolidate the decision guidance into a single section.
• Add validation steps after setup commands, e.g., 'vault read terraform/config' to verify configuration, and 'vault list terraform/role' to confirm role creation succeeded.
• Move CI/CD Integration examples, API Examples, and the Troubleshooting table into the referenced 'references/terraform-cloud-secrets.md' file to reduce the main skill's token footprint.

vault/multi-tenancy/skills/enterprise-features — 88% (PASSED)

  Description: 100%
    specificity: 3/3 - Lists multiple specific concrete actions/capabilities: namespaces, multi-tenancy, Performance Replication, Disaster Recovery replication, Sentinel policies, MFA (Login or Step-up), Control Groups, and HSM integration. These are all concrete, identifiable features.
    trigger_term_quality: 3/3 - Excellent coverage of natural terms users would say: 'namespaces', 'multi-tenancy', 'Performance Replication', 'Disaster Recovery', 'Sentinel policies', 'MFA', 'Control Groups', 'HSM integration', 'Vault Enterprise'. These are the exact terms practitioners use when working with Vault Enterprise.
    completeness: 3/3 - Clearly answers both 'what' (configure Vault Enterprise features covering namespaces, replication, Sentinel, MFA, Control Groups, HSM) and 'when' (explicit 'Use when asked about...' clause with specific trigger scenarios). Also adds a scoping note about enterprise-only capabilities.
    distinctiveness_conflict_risk: 3/3 - Highly distinctive with a clear niche: Vault Enterprise-specific features. The explicit mention of 'enterprise-only capabilities requiring Vault Enterprise license' and the enumeration of enterprise-specific features like Sentinel policies, Control Groups, and HSM integration clearly distinguish this from a general Vault skill.

    Assessment: This is a strong skill description that clearly identifies its domain (Vault Enterprise), lists specific capabilities, and includes an explicit 'Use when' clause with comprehensive trigger terms. The description is concise, uses third-person voice, and would be easily distinguishable from other Vault-related skills due to its explicit enterprise focus.

  Content: 75%
    conciseness: 2/3 - The skill is mostly efficient but has some redundancy—the 'When to Use Namespaces' decision table appears twice (once in the overview and once in the Namespaces section). The 'What Are You Trying to Solve?' section and the 'How Enterprise Features Work' summary both serve as overviews, creating slight duplication. Some explanatory text like 'Namespaces provide isolated Vault environments within a single cluster' tells Claude what it already knows.
    actionability: 3/3 - The skill provides fully executable bash commands for all major operations (namespace creation, replication setup, DR failover, MFA configuration, control group policies) and complete Sentinel policy examples in Python. Commands are copy-paste ready with clear placeholder values.
    workflow_clarity: 2/3 - Multi-step processes like replication setup are presented as sequential commands (enable primary → get token → enable secondary), which is clear. However, there are no explicit validation checkpoints—for example, no verification step after enabling replication, no health check after DR promotion, and no validation after namespace creation. These are potentially destructive operations that warrant feedback loops.
    progressive_disclosure: 2/3 - The skill references 'references/enterprise.md' for detailed configuration, which is good progressive disclosure structure. However, no bundle files are provided, so the referenced file doesn't exist. The main file itself is quite long (~200 lines) and some sections (like detailed Sentinel examples or MFA configuration) could be split into referenced files. The internal anchor navigation in the problem-oriented header is a nice touch.

    Assessment: This is a solid enterprise features skill with excellent actionability—concrete, executable commands and real Sentinel policy examples cover the major use cases well. The main weaknesses are the lack of validation/verification steps in multi-step workflows (especially for replication and DR failover), some content redundancy (duplicate namespace decision table), and the referenced enterprise.md file not being present in the bundle. The problem-oriented navigation at the top is an effective pattern.

Suggestions:

• Add explicit validation/verification steps after critical operations (e.g., vault read sys/replication/performance/status after enabling replication, health checks after DR promotion)
• Remove the duplicate 'When to Use Namespaces' table—keep it only in the Namespaces section and link to it from the overview
• Provide the referenced references/enterprise.md file or remove the reference if it doesn't exist

---

Checks: frontmatter validity, required fields, body structure, examples, line count.
Review score is informational — not used for pass/fail gating.