Skill · Security
Least Privilege Auditor
Audit application, CI, cloud, database, and agent permissions against observed usage, then produce a safe reduction plan with verification and rollback. Use when credentials have broad scopes, service roles grew organically, CI tokens can write too much, an agent or MCP server has excessive tools, or before a security review or compliance audit.
User-invocablev1.0.0
Updated Aug 4, 2026npx agentscamp add skills/least-privilege-auditorInstall to ~/.claude/skills/least-privilege-auditor/SKILL.md
Audits every principal, credential, role, CI token, database user, agent tool, and MCP integration against the actions it actually needs. It separates required, unused, and unverified privileges; identifies wildcard and cross-environment blast radius; then produces staged removals with tests, observability, rollback, and ownership rather than blindly tightening production access.
Audit permission scope without changing access. Produce evidence and a staged reduction plan; do not revoke credentials or edit policy unless the user explicitly expands the task.
Workflow
- Inventory principals and credentials. Find application service accounts, cloud roles, database users, CI tokens, deploy identities, human groups, third-party apps, agents, MCP servers, and long-lived keys. Record owner, environment, authentication method, and expiry.
- Map granted capability. Expand inherited roles, groups, wildcards, resource patterns, trust policies, and delegation. Include actions, resources, conditions, environments, and whether the identity may grant access onward.
- Map required behavior. Trace code, workflows, infrastructure, queries, tool declarations, and documented operations. Use audit logs when supplied, but treat absence of observed use as evidence to investigate—not proof that a disaster-recovery permission is unnecessary.
- Classify each grant. Mark
required,unused,excess scope,temporary, orunverified. Explain the exact resource and action difference between current and required access. - Prioritize blast radius. Raise wildcard write/admin access, cross-tenant or cross-environment scope, secret and identity management, policy mutation, production data export, and unbounded agent tools above harmless read-only excess.
- Design the target role. Prefer task-specific actions, named resources, environment separation, short-lived credentials, explicit conditions, and separate break-glass access with logging and expiry.
- Plan a safe rollout. Create the reduced role alongside the old one, test known workflows, canary it, monitor denials, and define rollback. Remove the old role only after the observation window.
- Identify governance gaps. Flag ownerless identities, unused long-lived keys, roles with no review date, shared credentials, missing audit logs, and exceptions without expiry.
WARNING
Do not remove a permission solely because it was absent from a short log window. Rare maintenance, recovery, and failover paths need explicit owners and tests before removal.
Output
Return:
- a principal-to-permission inventory with owners and environments
- findings ordered by blast radius, each showing current versus required scope
- a proposed least-privilege role or policy diff
- a staged test, canary, monitoring, and rollback plan
- time-bounded exceptions for rare required access
- governance gaps and the next review date
Frequently asked questions
- Is least privilege just removing wildcard permissions?
- No. Wildcards are a strong signal, but a narrowly named permission can still be unnecessary or scoped to every resource. Least privilege aligns actions, resources, environments, duration, and delegation with a principal's real job.
- How can permissions be reduced without breaking production?
- Combine static policy review with runtime evidence, create a proposed reduced role, test critical workflows in a lower environment, canary the role for a small principal set, monitor denied actions, and retain a time-bounded rollback path.
Related
- 9 Best Claude Skills for Code ReviewChoose Claude skills for security, correctness, maintainability, and focused pull request review without relying on one vague review prompt.
- RBAC DesignerDesign the authorization model itself — fine-grained permissions on resources composed into roles, with the right amount of resource/tenant scoping — instead of scattering role-name checks through handlers. Use when building multi-user or multi-tenant authorization, when `if user.isAdmin` checks are sprawling across the codebase, or when 'who can do what' needs a real model rather than ad-hoc gates.
- Auth Flow ReviewerRead-only review of authentication AND authorization flows — session/token model, cookie flags, CSRF, token rotation, password-reset/email-verification, OAuth redirect/state, and per-route object-level access checks — for exploitable gaps. Use before shipping login/session/token code, when adding a protected route or sharing-by-URL feature, or during a security pass. Reports findings by severity with location, impact, and the concrete fix; never edits code.
- Secret ScannerScan a repo or a diff for committed secrets — API keys, tokens, private keys, .env files, and high-entropy strings — then triage real leaks from fixtures. Use before pushing, in review, or when a credential may have leaked.
- Threat Model BuilderBuild a practical threat model for a feature or system using STRIDE — diagram the data flow, mark trust boundaries, enumerate concrete threats where data crosses them, and prioritize by likelihood × impact so security is reasoned about before shipping instead of bolted on after. Use when designing a feature that touches auth, money, or sensitive data, running a security design review, or hardening before a launch.
- Prompt Injection AuditorUse this agent to audit an LLM app or agent for prompt-injection exposure — mapping where untrusted content enters the model's context (user, RAG, tools, web), assessing the blast radius if an injection succeeds, probing with adversarial inputs, and recommending architectural mitigations. Examples — "audit our RAG agent for indirect prompt injection", "what's the blast radius if our agent gets injected — which tools and credentials are exposed?", "review our LLM app's trust boundaries and tell us what to fix".