Ghassan Gedeon Achi
d0aa161a36
Some updates to the `tctl access-review` command and skill based on some feedback from Roman. The changes here include: 1) Using `Granted By` instead of `Grantor` to reduce confusion around the noun (other columns, fields changed accordingly) 2) Defaulting the activitity window to 24h (instead unset by default) so that if IAC is available the access information is returned by default 3) Splitting the IAC error/warning into it's own JSON/YAML field and giving it a dedicated location in the text output (this is paired with an Access Graph PR that returns a `Not Configured` message when IAC is not enabled on the cluster (with links to docs).
Teleport Agent Skills
This directory contains Teleport agent skills. Each skill is a self-contained
package that teaches agents such as Claude Code how to perform a specific
Teleport workflow using CLI tools like tctl and tsh.
Installation
These skills follow the Agent Skills specification
and can be installed into any compatible agent (Claude Code, Cursor, Codex,
Gemini CLI, and others) using Vercel's skills
CLI, which discovers and installs skills straight from this repository:
# Auto-discover and enroll cloud infrastructure
npx skills add https://github.com/gravitational/teleport/tree/master/skills/teleport-discovery
# Session recording review
npx skills add https://github.com/gravitational/teleport/tree/master/skills/teleport-session-review
# Access list review
npx skills add https://github.com/gravitational/teleport/tree/master/skills/teleport-acl-review
# Investigate Identity Security Logs
npx skills add https://github.com/gravitational/teleport/tree/master/skills/teleport-investigate
# Review who can access which resources
npx skills add https://github.com/gravitational/teleport/tree/master/skills/teleport-access-review
You'll be prompted to pick which agents to install into and whether to install globally or per-project. Review a skill before use — skills run with your agent's full permissions.
Available Skills
teleport-acl-review
Helps perform bulk reviews of Teleport access lists that are due for periodic audit. Categorizes lists into low-risk that agent can auto-review and those that require human review.
Example invocations:
- Review my Teleport access lists
- Which access lists need review?
- Audit my Teleport ACLs
teleport-session-review
Helps browse, search, and investigate Teleport session recordings. Lists recent
recordings (tctl recordings ls), runs semantic and keyword search over session
summaries (tctl recordings search), presents a risk-triage table, and — with
confirmation — downloads a recording or hands you a playback link.
Install:
npx skills add https://github.com/gravitational/teleport/tree/master/skills/teleport-session-review
Example invocations:
- Review my recent Teleport session recordings
- Search session recordings for sessions that touched production databases
- What happened in session <id>?
- Find risky or high-severity sessions from last week
- Download the recording for session <id>
teleport-investigate
Helps search and explore Teleport's Identity Security activity log with
tctl investigate — finding who did what, where, and when across users,
resources, and integrations such as AWS, GitHub, and Okta.
Example invocations:
- Were there any failed authentications from India in the last 7 days?
- What did bot CI-deployer do yesterday?
- Show me who accessed the production-database resource this month
- Show me what activity was performed during the following access request
teleport-access-review
Helps review who can reach which resources and whether that access is actually
used, with tctl access-review and the access_path SQL query language —
access list / ACL recertification, "who can access this resource", "what can
this user access", attesting access for audit, and finding dormant or unused
standing privileges. Pairs with teleport-investigate (standing access vs.
historical activity).
Example invocations:
- Who can access the prod-db database?
- Review the Prod Admins access list and flag members who haven't used it in 90 days
- Does [email protected] have any unused standing access?
- What can the junior-dev role reach in production?
- Attest who can reach prod-db and which grants are dormant
teleport-discovery
Connect Teleport to your cloud to automatically discover and enroll your resources. Use Terraform to create an OIDC integration in your cloud provider and configure the Teleport Discovery Service. Troubleshoot any issues getting your resources enrolled. Supports AWS EC2 instances, AWS EKS clusters, and Azure VMS.
Example invocations:
- Enroll my AWS EC2 instances into Teleport
- Set up auto-discovery for my EKS clusters
- Enroll my Azure VMs into Teleport
- Why are my resources not enrolling into Teleport?