agent-identity-privilege-reviewer

What problem does it solve?

This Skill reviews how agents and sub-agents are identified, what privileges they hold, and how authority moves through delegation chains so you can catch escalation paths before they become incidents.

Core Features & Use Cases

• Identity inventory: Map each agent to the identity it runs under and flag shared, ambient, or over-broad credentials.
• Privilege analysis: Compare what each identity can do against what the agent actually needs, including scopes, roles, and tenant reach.
• Delegation and confused-deputy review: Trace user-to-agent-to-sub-agent-to-tool authority flow, verify attenuation, and detect privilege laundering or cross-tenant abuse.
• Dual attribution checks: Confirm that side effects can be attributed to both the human principal and the acting agent, not just a service account.
• Use Case: A platform team asks whether its orchestrator can safely spawn workers with narrower, task-scoped credentials instead of reusing one powerful token across the whole fleet.

Quick Start

Review the agent identity architecture for shared accounts, privilege excess, delegation attenuation failures, confused-deputy risks, and missing principal-plus-agent attribution.