Claude skill to audit admin access

Severity: Optional

Check automatically:

1. Look for audit automation:

# Find audit scripts or skills
find . -type f \( -name "*.md" -o -name "*.ts" -o -name "*.js" \) -exec grep -l -iE "audit.*admin|admin.*audit|check.*access" {} \; | head -10

# Look in skills/scripts folders
ls -la skills/ scripts/ tools/ 2>/dev/null

# Find runbooks
find . -type f -name "*.md" -exec grep -l -iE "runbook|playbook|admin.*review" {} \; | head -5

2. Check for API access to admin data:

# Look for admin user listing API
grep -riE "api.*(admin|users)|getAdminUsers|listAdmins" --include="*.ts" --include="*.js" | head -10

Ask user:

• Is there an automated way to audit admin access? (script, Claude skill, runbook)
• Can an AI agent enumerate admin users and flag anomalies?
• If not, would this be valuable to create?

Pass criteria:

• Automated tooling exists to audit admin access
• OR clear runbook/process that could be automated
• Audit can identify: inactive admins, over-privileged users, missing MFA

Fail criteria:

• No automation or clear process for admin audits
• Auditing requires manual DB queries with no documentation

Evidence to capture:

• Existing audit tooling (if any)
• Gap: what automation would be valuable
• Recommendation for creating audit skill

---