More screenshots
Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsCredential Scope Reduction & Access Readiness Review
Over-privileged service accounts and bloated token claims are silent security debts that lead to massive lateral movement during a breach.
$5
Credential Scope Reduction & Access Readiness Review
Example session with this skill installed
We want to reduce an internal deployment service account from broad project-admin access to a smaller custom role. It deploys the API, reads one secret, updates two Cloud Run services, and writes release metadata. Two old scripts still use the same account, but nobody is sure whether they need storage access.
- Read your context and instructions
- Compiled the credential scope reduction
- Generated the document
NOT READY
Case analyzed
We want to reduce an internal deployment service account from broad project-admin access to a smaller custom role. It deploys the API, reads one secret, updates two Cloud Run services, and writes release metadata. Two old scripts still use the same account, but nobody is sure whether they need storage access.
The supplied facts are sufficient to perform a concrete readiness review for this case. No repository, production, vendor, or legal access is assumed.
Verified evidence
- VERIFIED: The deployment account currently has broad project-admin access.
- VERIFIED: The known required actions are API deployment, one secret read, updates to two Cloud Run services, and release-metadata writes.
- VERIFIED: Two legacy scripts still share the credential.
- VERIFIED: The need for storage access is unknown.
Concrete findings
- The broad credential cannot be narrowed by deleting permissions one at a time because two legacy scripts are still undocumented consumers.
- The known deployment path already decomposes into API deployment, one secret read, two Cloud Run updates, and release-metadata writes.
- Storage access is an unresolved dependency, not a permission to retain by default; inspect the two legacy scripts or their audit logs before adding it to the custom role.
- Rollback should restore the previous role binding without rotating credential identity, so permission testing is not mixed with a credential-change event.
The canonical acceptance rule is
A credential can be narrowed safely only when every required operation is mapped to explicit permissions, hidden transitive dependencies are surfaced, rollback is bounded, and post-change evidence proves that excess access was removed without breaking required work.
The current re
credential-scope-reduction-access-readin.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Over-privileged service accounts and bloated token claims are silent security debts that lead to massive lateral movement during a breach. This skill identifies exactly where permissions exceed operational requirements and provides a surgical plan to narrow them without breaking your services.
What it does
- Permission Mapping translates required operations into the minimum viable set of IAM permissions or token claims.
- Dependency Surfacing identifies hidden transitive permissions that often cause scope reduction to fail in production.
- Rollout Sequencing generates step-by-step plans for narrowing scopes including specific rollback triggers and bounds.
- Emergency Access Handling defines how to maintain break-glass procedures while tightening standard service boundaries.
- Verification Logic provides deterministic tests to prove excess access is gone while legitimate traffic still flows.
How it works
- Analyze the current permission inventory and operational logs to map required vs. granted access.
- Diagnose specific over-provisioning risks and identify the security boundaries owning the credentials.
- Execute a repair plan or readiness review with explicit gates and bounded implementation steps.
- Validate the changes using post-change evidence or local inspection to ensure zero breakage of public interfaces.
Frameworks & tools
Works with IAM policies, service account configurations, JWT/OIDC token claims, and cloud provider permission sets (AWS, GCP, Azure).
Why this beats prompting it yourself
Generic prompts often suggest "least privilege" without considering the transitive dependencies that break apps at 2 AM. This skill enforces a canonical invariant that maps every operation to an explicit permission and a rollback path, ensuring security doesn't come at the cost of uptime.
Use cases
- Auditing a legacy service account before migrating to a new cloud environment.
- Reducing the scope of a CI/CD runner token that has cluster-admin rights.
- Reviewing a third-party API integration to ensure token claims are properly bounded.
Known limitations
Requires specific evidence or repository access to move beyond hypotheses. Does not perform live production changes without explicit authorization.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean today
- Passed all security checks, Safe to install