How do I install the Widefield Identity Threat Doctor skill?

Run npx skillmds@latest add chambear2809/widefield-identity-threat-doctor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Widefield Identity Threat Doctor safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Widefield Identity Threat Doctor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Widefield Identity Threat Doctor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Widefield Identity Threat Doctor?

chambear2809 (@chambear2809) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Widefield Identity Threat Doctor by chambear2809

Name: Widefield Identity Threat Doctor
Rating: 4.2 (5 reviews)
Author: chambear2809

Widefield Identity Threat Doctor

Use when the user asks to investigate WideField findings, audit identity threat coverage, build remediation packets, or validate OAuth/NHI/AI-agent identity risks without destructive remediation. Diagnose WideField identity threat coverage for OAuth token abuse, rogue or over-privileged apps, non- human identity ownership, MFA and credential posture, AI-agent identities, and anomalous sessions using read-only Splunk, Okta, and evidence checks.

chambear2809 Updated Sep 22, 2026

File contents

WideField Identity Threat Doctor

Prerequisites

Tool or access	Purpose	Verify
Bash and Python 3	Run bundled setup and validation helpers	`bash --version && python3 --version`
Required product/platform access	Inspect or configure the selected target	Complete the documented preflight
Credential files for live modes	Keep secrets out of chat	Verify paths only

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

Investigate WideField findings, audit identity threat coverage, build remediation packets, or validate OAuth/NHI/AI-agent identity risks without destructive remediation.
Preview and review the widefield identity threat doctor workflow before any live apply phase.
Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Scope

Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.

Examples

Inspect the supported setup modes before selecting one:

bash skills/widefield-identity-threat-doctor/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/widefield-identity-threat-doctor/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

Issue	Cause	Resolution
Preflight fails	A required tool or access path is missing	Resolve it before rendering or applying
Rendered assets are incomplete	Required non-secret inputs are absent	Complete intake and render again
Apply is blocked	Review, credentials, or explicit acceptance is missing	Use the documented handoff
Validation is incomplete	Live evidence is unavailable	Record the gap and keep completion open

Run read-only coverage checks and render gated remediation packets for WideField identity threats across identity posture, connected apps, NHI ownership, AI access, and sessions.

Workflow

bash skills/widefield-identity-threat-doctor/scripts/setup.sh --render
bash skills/widefield-identity-threat-doctor/scripts/validate.sh --dry-run

When Splunk or Okta credentials are available in files, validation can check WideField events and Okta System Log reachability:

bash skills/widefield-identity-threat-doctor/scripts/validate.sh \
  --okta-org-url https://example.okta.com \
  --okta-token-file /secure/okta/api_token

Remediation Gate

Doctor mode is read-only by default. Destructive actions such as revoking sessions, removing app grants, resetting passwords, or changing governance policy must be executed by the target owner skill with explicit target-specific acceptance and documented runbooks.

---name: widefield-identity-threat-doctordescription: Use when the user asks to investigate WideField findings, audit identity threat coverage, build remediation packets, or validate OAuth/NHI/AI-agent identity risks without destructive remediation. Diagnose WideField identity threat coverage for OAuth token abuse, rogue or over-privileged apps, non- human identity ownership, MFA and credential posture, AI-agent identities, and anomalous sessions using read-only Splunk, Okta, and evidence checks.---# WideField Identity Threat Doctor## Prerequisites| Tool or access | Purpose | Verify ||---|---|---|| Bash and Python 3 | Run bundled setup and validation helpers | `bash --version && python3 --version` || Required product/platform access | Inspect or configure the selected target | Complete the documented preflight || Credential files for live modes | Keep secrets out of chat | Verify paths only |## Workflow Overview```text┌───────────┐ ┌───────────────┐ ┌───────────────┐ ┌─────────────────┐│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │└───────────┘ └───────────────┘ └───────────────┘ └─────────────────┘```## When to Activate- Investigate WideField findings, audit identity threat coverage, build remediation packets, or validate OAuth/NHI/AI-agent identity risks without destructive remediation.- Preview and review the widefield identity threat doctor workflow before any live apply phase.- Diagnose failed prerequisites, generated assets, configuration, or validation evidence.## ScopeFollow the documented read-only or render-first path whenever it is available.This skill does not imply permission to mutate live systems. Require explicitapply flags, protected credentials, and operator review for state changes.## ExamplesInspect the supported setup modes before selecting one:```bashbash skills/widefield-identity-threat-doctor/scripts/setup.sh --help```Expected output: usage, supported modes, and required arguments are displayedwithout changing the target environment.Inspect validation modes before running completion checks:```bashbash skills/widefield-identity-threat-doctor/scripts/validate.sh --help```Expected output: offline, live, and completion options are displayed when theskill supports them; help exits without mutation.## Troubleshooting| Issue | Cause | Resolution ||---|---|---|| Preflight fails | A required tool or access path is missing | Resolve it before rendering or applying || Rendered assets are incomplete | Required non-secret inputs are absent | Complete intake and render again || Apply is blocked | Review, credentials, or explicit acceptance is missing | Use the documented handoff || Validation is incomplete | Live evidence is unavailable | Record the gap and keep completion open |Run read-only coverage checks and render gated remediation packets forWideField identity threats across identity posture, connected apps, NHIownership, AI access, and sessions.## Workflow```bashbash skills/widefield-identity-threat-doctor/scripts/setup.sh --renderbash skills/widefield-identity-threat-doctor/scripts/validate.sh --dry-run```When Splunk or Okta credentials are available in files, validation can checkWideField events and Okta System Log reachability:```bashbash skills/widefield-identity-threat-doctor/scripts/validate.sh \ --okta-org-url https://example.okta.com \ --okta-token-file /secure/okta/api_token```## Remediation GateDoctor mode is read-only by default. Destructive actions such as revokingsessions, removing app grants, resetting passwords, or changing governancepolicy must be executed by the target owner skill with explicittarget-specific acceptance and documented runbooks.

Frequently asked questions