How do I install the Origin Permission Audit skill?

Run npx skillmds@latest add aki2022/origin-permission-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Origin Permission Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Origin Permission Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Origin Permission Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Origin Permission Audit?

Aki2022 (@aki2022) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Origin Permission Audit by aki2022 — Agent Skill

Name: Origin Permission Audit
Rating: 4.666666666666667 (3 reviews)
Author: Aki2022

Origin Permission Audit

Audit and safely settle elevated access granted during the current or resumed session. Use when a task granted IAM roles, API scopes, bucket bindings, or other temporary access and the session is closing, or when the caller explicitly asks to audit or revoke session-granted permissions. Classify grants as temporary or standing, revoke temporary grants, verify the removal, and report the result; do not audit pre-existing access by guesswork.

Aki2022 Updated Sep 10, 2026

File contents

origin-permission-audit

Audit only access granted by the current session or a resumed session whose history is visible. Do not infer that an older grant belongs to this session. This skill owns permission discovery, classification, revocation, and verification; it does not own repository documentation or ADR creation.

Workflow

List every grant this session made: principal, project or resource, exact role/scope, and reason. Include IAM roles, API scopes, bucket-level bindings, and equivalent elevated access.
Classify each grant as temporary or standing.
- Treat one-off investigation, remediation, or debugging access as temporary by default, including read-only access.
- Treat access as standing only when a documented recurring workstream or automation depends on it going forward.
- Do not relitigate pre-existing grants.
For each temporary grant, revoke it now using the narrowest available command. Do not defer the revocation to documentation or a later session.
Re-query the exact principal/resource and verify that the grant is gone and the documented baseline remains. If revocation is blocked by an access boundary, return the exact command for the human, wait for confirmation, then verify.
Leave standing grants unchanged and record why they are required.

Safety boundaries

Resolve the exact principal, resource, role, and scope before changing anything.
Never use a broad project-wide or wildcard removal when a narrower binding can be targeted.
Never revoke access that predates the session based only on suspicion.
Never claim success from a removal command alone; verification is required.
If the caller has not authorized the relevant external operation or the action is outside the session's authorization envelope, stop and report the gate.

Handoff contract

Return a concise per-grant report containing: grant identity, temporary/standing classification, action taken, verification result, and any human gate or exact command. Report "no session-granted elevated access" when none exists.

Pass this report to origin-doc-update through the caller. That skill decides whether an operational guide or ADR needs updating. Do not create a second permission-history document here. origin-close-session invokes this skill before documentation and git cleanup when the audit applies.

---name: origin-permission-auditdescription: Audit and safely settle elevated access granted during the current or resumed session. Use when a task granted IAM roles, API scopes, bucket bindings, or other temporary access and the session is closing, or when the caller explicitly asks to audit or revoke session-granted permissions. Classify grants as temporary or standing, revoke temporary grants, verify the removal, and report the result; do not audit pre-existing access by guesswork.---# origin-permission-auditAudit only access granted by the current session or a resumed session whose history is visible. Do not infer that an older grant belongs to this session. This skill owns permission discovery, classification, revocation, and verification; it does not own repository documentation or ADR creation.## Workflow1. List every grant this session made: principal, project or resource, exact role/scope, and reason. Include IAM roles, API scopes, bucket-level bindings, and equivalent elevated access.2. Classify each grant as `temporary` or `standing`. - Treat one-off investigation, remediation, or debugging access as temporary by default, including read-only access. - Treat access as standing only when a documented recurring workstream or automation depends on it going forward. - Do not relitigate pre-existing grants.3. For each temporary grant, revoke it now using the narrowest available command. Do not defer the revocation to documentation or a later session.4. Re-query the exact principal/resource and verify that the grant is gone and the documented baseline remains. If revocation is blocked by an access boundary, return the exact command for the human, wait for confirmation, then verify.5. Leave standing grants unchanged and record why they are required.## Safety boundaries- Resolve the exact principal, resource, role, and scope before changing anything.- Never use a broad project-wide or wildcard removal when a narrower binding can be targeted.- Never revoke access that predates the session based only on suspicion.- Never claim success from a removal command alone; verification is required.- If the caller has not authorized the relevant external operation or the action is outside the session's authorization envelope, stop and report the gate.## Handoff contractReturn a concise per-grant report containing: grant identity, temporary/standing classification, action taken, verification result, and any human gate or exact command. Report "no session-granted elevated access" when none exists.Pass this report to `origin-doc-update` through the caller. That skill decides whether an operational guide or ADR needs updating. Do not create a second permission-history document here. `origin-close-session` invokes this skill before documentation and git cleanup when the audit applies.

Frequently asked questions