Find the 200 orphaned accounts with admin privileges nobody knew about
Audits user accounts, service accounts, and access keys across your cloud and identity providers. Finds orphaned accounts, unused access keys, over-privileged service accounts, and users who left months ago but still have access.
Create a skill called "Access Auditor". Audit access and identity across cloud infrastructure: AWS IAM: 1. `aws iam list-users` — list all users and their last login date 2. `aws iam list-access-keys` for each user — find unused keys (90+ days) 3. `aws iam list-roles` — find roles with admin policies or wildcard permissions 4. Check for root account access keys (should never exist) 5. Check MFA status for all users 6. Check password age and rotation policy compliance Kubernetes RBAC: 1. List all ClusterRoleBindings and RoleBindings 2. Find bindings to subjects that reference non-existent users or groups 3. Identify overly broad ClusterRoles (cluster-admin granted too widely) 4. Find ServiceAccounts with excessive permissions Cross-reference: - If an employee list is provided, identify accounts that don't match any current employee - Flag accounts with admin access that haven't been active in 60+ days Generate remediation steps for each finding, categorized by risk.
People leave, roles change, but access permissions persist forever unless
someone explicitly removes them. This skill finds the gaps before an
auditor (or an attacker) does.
Generate SOC2 evidence in minutes, not weeks
Runs infrastructure compliance checks using open-source tools (checkov, tfsec, kube-bench, prowler) and generates formatted evidence mapped to compliance framework controls. Turns weeks of screenshot-taking into an automated evidence package.
Debug "Access Denied" without guessing which of 47 policies is wrong
Traces the full IAM policy evaluation chain when you hit an Access Denied — identity policies, resource policies, SCPs, permission boundaries — and tells you exactly which policy is blocking and how to fix it.
A calm checklist when fraud hits
Immediate steps, reporting sequences, and long-term hardening for scams and identity theft. Organized by urgency so you know what to do first.
Verify brand offers before you click anything
Screens incoming partnership offers for phishing and scam patterns: suspicious domains, attachments, fake checks, requests to "connect your account," and vague contracts. Outputs a risk rating and safe verification steps.