Name: sec-access-review
Author: Matrixx0070

About

Imported from Matrixx0070/sudo-skills (docs/skills/sec-access-review/SKILL.md). Install upstream with npx skills add Matrixx0070/sudo-skills --skill sec-access-review. Copyright stays with the author.

When to use

Use this on a recurring cadence (quarterly is common), during audits, or after reorgs and offboarding waves. It enforces least privilege and removes access that is no longer justified.

Not for: using discovered credentials to access systems; privilege escalation testing; or bulk-revoking without owner sign-off. Review and recommend — revocation follows attestation, not a hunch.

Method

Gather inventory. Collect all identities (users, service accounts, API keys) and their granted roles/permissions across systems. Include group and inherited access.
Establish expected access. For each identity, determine the role its job actually requires. Note owners and last-login/last-used timestamps.
Find stale accounts. Flag disabled-but-not-removed users, accounts with no activity past a threshold, orphaned service accounts, and unused API keys.
Detect over-provisioning. Compare granted vs. required permissions. Decision point: standing admin or wildcard grants used rarely are candidates for just-in-time access rather than permanent rights.
Detect role drift. Identify permissions accumulated across role changes that were never revoked, and separation-of-duties conflicts (e.g., the same identity approves and executes payments).
Remediate. Decision point: recommend revoke, downgrade, or convert-to-JIT for each finding — and require owner attestation for any access retained.

Example

Identity svc-reporting holds db:admin but its job is read-only exports. Last used for a write: never (90-day window). Justified: no. Recommended action: downgrade to db:readonly; if occasional schema tasks arise, grant db:admin just-in-time. Owner @data-eng must attest to the downgrade before it is applied.

Pitfalls

Reviewing users but skipping service accounts and API keys. Non-human identities accumulate the most unnoticed standing privilege.
Missing inherited access. A user may look minimal directly but hold admin via a group; expand group and role inheritance.
Revoking without attestation. Silent removal breaks jobs and erodes trust; require the owner to confirm each retained or removed grant.
Treating the report as the outcome. Findings without tracked remediation recur every quarter; assign owners and due dates.

Output format

## Review scope
Systems: <>. Identities reviewed: <count>.

## Findings
| Identity | System | Current access | Justified? | Last used | Recommended action |
|----------|--------|----------------|------------|-----------|--------------------|

## Remediation list
| Identity | Action (revoke/downgrade/JIT/attest) | Owner | Due |
|----------|--------------------------------------|-------|-----|

## Trends
- <recurring drift or offboarding-process gaps>

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/matrixx0070-sudo-skills-sec-access-review/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

matrixx0070-sudo-skills-sec-access-review.ocm.jsonjson

{
  "ocm": "1",
  "id": "matrixx0070-sudo-skills-sec-access-review",
  "kind": "skill",
  "name": "sec-access-review",
  "description": "Run a periodic least-privilege access review that finds stale accounts, over-provisioning, and role drift, with owner attestation.",
  "publisher": "Matrixx0070",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "security",
      "iam",
      "access-review",
      "least-privilege",
      "governance",
      "defensive",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Run a periodic least-privilege access review that finds stale accounts, over-provisioning, and role drift, with owner attestation."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/Matrixx0070/sudo-skills",
      "path": "docs/skills/sec-access-review/SKILL.md",
      "ref": "6bc5cc2f77b1ae38553e590c7511fbfdd5e1317e",
      "url": "https://github.com/Matrixx0070/sudo-skills/blob/6bc5cc2f77b1ae38553e590c7511fbfdd5e1317e/docs/skills/sec-access-review/SKILL.md",
      "key": "Matrixx0070/sudo-skills/docs/skills/sec-access-review/SKILL.md"
    }
  },
  "instructions": "## When to use\n\nUse this on a recurring cadence (quarterly is common), during audits, or after reorgs and offboarding waves. It enforces least privilege and removes access that is no longer justified.\n\n**Not for:** using discovered credentials to access systems; privilege escalation testing; or bulk-revoking without owner sign-off. Review and recommend — revocation follows attestation, not a hunch.\n\n## Method\n\n1. **Gather inventory.** Collect all identities (users, service accounts, API keys) and their granted roles/permissions across systems. Include group and inherited access.\n2. **Establish",
  "cost": {
    "context_tokens": 703
  }
}

Fetch it by URL: GET /api/v1/registry/matrixx0070-sudo-skills-sec-access-review/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.