auditclaw-idp

What This Skill Does

AuditClaw IDP is a specialized security auditing skill designed to integrate seamlessly with the auditclaw-grc framework. It functions as an automated evidence collector for identity providers, specifically Google Workspace and Okta. The skill performs 8 distinct read-only compliance checks across these platforms, focusing on critical security indicators such as Multi-Factor Authentication (MFA) status, administrative audit logs, inactive account identification, and password policy enforcement. By automating the extraction of this data, AuditClaw IDP eliminates the need for manual reporting, providing security teams with a verifiable audit trail stored directly in the shared GRC SQLite database.

Installation

To install this skill, use the ClawHub command-line interface: clawhub install openclaw/skills/skills/mailnike/auditclaw-idp. Ensure that you have the auditclaw-grc skill installed and initialized beforehand, as the IDP skill relies on the shared database schema. After installation, verify the requirements by running pip install -r scripts/requirements.txt. Configuration requires setting environment variables for your chosen identity providers—either a Google Workspace service account JSON file for domain-wide delegation or an Okta API token with the relevant read-only scopes. No credentials are persisted by the skill, ensuring security remains a priority.

Use Cases

AuditClaw IDP is primarily used for compliance reporting and continuous monitoring. Security auditors use this skill to generate point-in-time evidence for ISO 27001, SOC2, or internal compliance audits without needing manual administrative access to identity consoles. It is also invaluable for IT administrators who need a quick pulse-check on identity security posture, such as identifying accounts that have bypassed MFA or detecting stale user accounts that pose a security risk if left active in the system.

Example Prompts

1. "OpenClaw, run a full IDP evidence sweep to update my compliance database with current Okta and Google Workspace security settings."
2. "Can you check if there are any Google Workspace users currently without MFA enabled?"
3. "Show me the status of our IDP integration health, including when the last successful scan occurred and if there were any API errors."

Tips & Limitations

When using AuditClaw IDP, remember that it operates strictly on read-only permissions. This is a security feature, but it means you cannot use the skill to remediate findings; it identifies the gap, and you must manually resolve it in the respective dashboard. The skill assumes you have correctly configured the necessary API scopes; if you encounter errors, verify your Service Account or API Token permissions. Finally, ensure your ~/.openclaw/grc/compliance.sqlite path remains accessible to the script to prevent database write failures during the evidence collection process.