{
  "schemaVersion": "1.0",
  "item": {
    "slug": "auditclaw-idp",
    "name": "AuditClaw Idp",
    "source": "tencent",
    "type": "skill",
    "category": "效率提升",
    "sourceUrl": "https://clawhub.ai/mailnike/auditclaw-idp",
    "canonicalUrl": "https://clawhub.ai/mailnike/auditclaw-idp",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/auditclaw-idp",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=auditclaw-idp",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "README.md",
      "scripts/requirements.txt",
      "scripts/checks/google_mfa.py",
      "scripts/checks/okta_inactive.py",
      "scripts/checks/google_admins.py",
      "scripts/checks/okta_mfa.py"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-23T16:43:11.935Z",
      "expiresAt": "2026-04-30T16:43:11.935Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard",
        "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/auditclaw-idp"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/auditclaw-idp",
    "agentPageUrl": "https://openagent3.xyz/skills/auditclaw-idp/agent",
    "manifestUrl": "https://openagent3.xyz/skills/auditclaw-idp/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/auditclaw-idp/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "AuditClaw IDP",
        "body": "Companion skill for auditclaw-grc. Collects compliance evidence from Google Workspace and Okta identity providers using read-only API calls.\n\n8 checks | Read-only API access | Evidence stored in shared GRC database"
      },
      {
        "title": "Security Model",
        "body": "Read-only access: Google Workspace uses admin.directory.user.readonly scope only. Okta uses okta.users.read, okta.factors.read, okta.policies.read scopes only. No write/modify permissions.\nCredentials: Uses standard env vars for each provider. No credentials stored by this skill.\nDependencies: Google API client + requests (all pinned in requirements.txt)\nData flow: Check results stored as evidence in ~/.openclaw/grc/compliance.sqlite via auditclaw-grc"
      },
      {
        "title": "Prerequisites",
        "body": "Google Workspace: Service account JSON with domain-wide delegation, admin email for impersonation\nOkta: API token (SSWS) with read-only scopes\npip install -r scripts/requirements.txt\nauditclaw-grc skill installed and initialized"
      },
      {
        "title": "Google Workspace (optional; skip if not configured)",
        "body": "GOOGLE_WORKSPACE_SA_KEY: Path to service account JSON file\nGOOGLE_WORKSPACE_ADMIN_EMAIL: Super admin email to impersonate"
      },
      {
        "title": "Okta (optional; skip if not configured)",
        "body": "OKTA_ORG_URL: Okta organization URL (e.g., https://mycompany.okta.com)\nOKTA_API_TOKEN: Okta API token"
      },
      {
        "title": "Commands",
        "body": "\"Run IDP evidence sweep\": Run all checks for configured providers\n\"Check Google Workspace MFA\": Run Google MFA check\n\"Check Okta password policies\": Run Okta password policy check\n\"Show IDP integration health\": Last sync, errors, evidence count"
      },
      {
        "title": "Usage",
        "body": "All evidence is stored in the shared GRC database at ~/.openclaw/grc/compliance.sqlite\nvia the auditclaw-grc skill's db_query.py script.\n\nTo run a full evidence sweep (all configured providers):\n\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --all\n\nTo run checks for a specific provider:\n\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --provider google\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --provider okta\n\nTo run specific checks:\n\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --checks google_mfa,okta_mfa"
      },
      {
        "title": "Check Categories (8)",
        "body": "CheckProviderWhat It Verifiesgoogle_mfaGoogle WorkspaceAll active users have 2SV enrolled + enforcedgoogle_adminsGoogle WorkspaceSuper admin count 2-4, all with 2SVgoogle_inactiveGoogle WorkspaceNo active users with lastLoginTime > 90 daysgoogle_passwordsGoogle WorkspaceAll users have passwordStrength == \"STRONG\"okta_mfaOktaAll active users have at least 1 MFA factor enrolledokta_passwordsOktaPassword policy: minLength>=12, history>=5, maxAttempts<=5, maxAge<=90okta_inactiveOktaNo active users with lastLogin > 90 daysokta_sessionsOktaMFA required, session lifetime <= 12h, idle <= 1h"
      },
      {
        "title": "Evidence Storage",
        "body": "Each check produces evidence items stored with:\n\nsource: \"idp\"\ntype: \"automated\"\ncontrol_id: Mapped to relevant SOC2/ISO/NIST/HIPAA controls\ndescription: Human-readable finding summary\nfile_content: JSON details of the check result"
      },
      {
        "title": "Setup Guide",
        "body": "AuditClaw supports two identity providers. Configure one or both."
      },
      {
        "title": "Google Workspace Setup",
        "body": "Step 1: Enable Admin SDK API\nGo to Google Cloud Console → APIs & Services → Library → Enable \"Admin SDK API\"\n\nStep 2: Create Service Account\nIAM & Admin → Service Accounts → Create. Enable domain-wide delegation.\n\nStep 3: Grant OAuth Scopes\nIn Google Admin → Security → API controls → Domain-wide delegation, add the service account with:\n\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\nhttps://www.googleapis.com/auth/admin.reports.audit.readonly\n\nStep 4: Set Environment Variables\n\nGOOGLE_WORKSPACE_SA_KEY=/path/to/service-account.json\nGOOGLE_WORKSPACE_ADMIN_EMAIL=admin@yourdomain.com"
      },
      {
        "title": "Okta Setup",
        "body": "Step 1: Create API Token\nOkta Admin → Security → API → Tokens → Create Token. Name: auditclaw-scanner\n\nStep 2: Required Permissions\nThe token inherits the creating admin's permissions. Needs read access to: users, factors, policies.\nScopes: okta.users.read, okta.factors.read, okta.policies.read\n\nStep 3: Set Environment Variables\n\nOKTA_ORG_URL=https://mycompany.okta.com\nOKTA_API_TOKEN=your-token-here"
      },
      {
        "title": "Verify Connection",
        "body": "Run: python3 {baseDir}/scripts/idp_evidence.py --test-connection\n\nThe exact permissions are documented in scripts/idp-permissions.json. Show with:\npython3 {baseDir}/../auditclaw-grc/scripts/db_query.py --action show-policy --provider idp"
      }
    ],
    "body": "AuditClaw IDP\n\nCompanion skill for auditclaw-grc. Collects compliance evidence from Google Workspace and Okta identity providers using read-only API calls.\n\n8 checks | Read-only API access | Evidence stored in shared GRC database\n\nSecurity Model\nRead-only access: Google Workspace uses admin.directory.user.readonly scope only. Okta uses okta.users.read, okta.factors.read, okta.policies.read scopes only. No write/modify permissions.\nCredentials: Uses standard env vars for each provider. No credentials stored by this skill.\nDependencies: Google API client + requests (all pinned in requirements.txt)\nData flow: Check results stored as evidence in ~/.openclaw/grc/compliance.sqlite via auditclaw-grc\nPrerequisites\nGoogle Workspace: Service account JSON with domain-wide delegation, admin email for impersonation\nOkta: API token (SSWS) with read-only scopes\npip install -r scripts/requirements.txt\nauditclaw-grc skill installed and initialized\nEnvironment Variables\nGoogle Workspace (optional; skip if not configured)\nGOOGLE_WORKSPACE_SA_KEY: Path to service account JSON file\nGOOGLE_WORKSPACE_ADMIN_EMAIL: Super admin email to impersonate\nOkta (optional; skip if not configured)\nOKTA_ORG_URL: Okta organization URL (e.g., https://mycompany.okta.com)\nOKTA_API_TOKEN: Okta API token\nCommands\n\"Run IDP evidence sweep\": Run all checks for configured providers\n\"Check Google Workspace MFA\": Run Google MFA check\n\"Check Okta password policies\": Run Okta password policy check\n\"Show IDP integration health\": Last sync, errors, evidence count\nUsage\n\nAll evidence is stored in the shared GRC database at ~/.openclaw/grc/compliance.sqlite via the auditclaw-grc skill's db_query.py script.\n\nTo run a full evidence sweep (all configured providers):\n\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --all\n\n\nTo run checks for a specific provider:\n\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --provider google\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --provider okta\n\n\nTo run specific checks:\n\npython3 scripts/idp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --checks google_mfa,okta_mfa\n\nCheck Categories (8)\nCheck\tProvider\tWhat It Verifies\ngoogle_mfa\tGoogle Workspace\tAll active users have 2SV enrolled + enforced\ngoogle_admins\tGoogle Workspace\tSuper admin count 2-4, all with 2SV\ngoogle_inactive\tGoogle Workspace\tNo active users with lastLoginTime > 90 days\ngoogle_passwords\tGoogle Workspace\tAll users have passwordStrength == \"STRONG\"\nokta_mfa\tOkta\tAll active users have at least 1 MFA factor enrolled\nokta_passwords\tOkta\tPassword policy: minLength>=12, history>=5, maxAttempts<=5, maxAge<=90\nokta_inactive\tOkta\tNo active users with lastLogin > 90 days\nokta_sessions\tOkta\tMFA required, session lifetime <= 12h, idle <= 1h\nEvidence Storage\n\nEach check produces evidence items stored with:\n\nsource: \"idp\"\ntype: \"automated\"\ncontrol_id: Mapped to relevant SOC2/ISO/NIST/HIPAA controls\ndescription: Human-readable finding summary\nfile_content: JSON details of the check result\nSetup Guide\n\nAuditClaw supports two identity providers. Configure one or both.\n\nGoogle Workspace Setup\n\nStep 1: Enable Admin SDK API Go to Google Cloud Console → APIs & Services → Library → Enable \"Admin SDK API\"\n\nStep 2: Create Service Account IAM & Admin → Service Accounts → Create. Enable domain-wide delegation.\n\nStep 3: Grant OAuth Scopes In Google Admin → Security → API controls → Domain-wide delegation, add the service account with:\n\nhttps://www.googleapis.com/auth/admin.directory.user.readonly\nhttps://www.googleapis.com/auth/admin.reports.audit.readonly\n\nStep 4: Set Environment Variables\n\nGOOGLE_WORKSPACE_SA_KEY=/path/to/service-account.json\nGOOGLE_WORKSPACE_ADMIN_EMAIL=admin@yourdomain.com\nOkta Setup\n\nStep 1: Create API Token Okta Admin → Security → API → Tokens → Create Token. Name: auditclaw-scanner\n\nStep 2: Required Permissions The token inherits the creating admin's permissions. Needs read access to: users, factors, policies. Scopes: okta.users.read, okta.factors.read, okta.policies.read\n\nStep 3: Set Environment Variables\n\nOKTA_ORG_URL=https://mycompany.okta.com\nOKTA_API_TOKEN=your-token-here\nVerify Connection\n\nRun: python3 {baseDir}/scripts/idp_evidence.py --test-connection\n\nThe exact permissions are documented in scripts/idp-permissions.json. Show with: python3 {baseDir}/../auditclaw-grc/scripts/db_query.py --action show-policy --provider idp"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/mailnike/auditclaw-idp",
    "publisherUrl": "https://clawhub.ai/mailnike/auditclaw-idp",
    "owner": "mailnike",
    "version": "1.0.2",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/auditclaw-idp",
    "downloadUrl": "https://openagent3.xyz/downloads/auditclaw-idp",
    "agentUrl": "https://openagent3.xyz/skills/auditclaw-idp/agent",
    "manifestUrl": "https://openagent3.xyz/skills/auditclaw-idp/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/auditclaw-idp/agent.md"
  }
}