القائمة
Audit the IRIS instance's security posture: users (default passwords, %All holders), roles, service authentication settings, SSL/TLS configs, and instance auditing status.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | audit-security-posture |
| description | Audit the IRIS instance's security posture: users (default passwords, %All holders), roles, service authentication settings, SSL/TLS configs, and instance auditing status. |
No server profile specified — omit server (or pass "") to use the default server on every tool call below.
This is a READ-ONLY audit — every call below is a read action. Do not modify any user, role, service, or SSL configuration as part of this workflow.
iris_user_get with no name (lists all users). For each enabled user, check: does changePasswordOnNextLogin/expiration look stale or absent, and — for any account you suspect uses a well-known default credential (e.g. _SYSTEM, Admin, SuperUser) — flag it for the user to verify manually (never attempt to test a password via this workflow).iris_role_list to enumerate all roles and their granted resources. Identify every role holding %All (or a resource with unrestricted RWU-style permission) — these are super-user-equivalent roles.roles field for %All (directly, or via a role from step 2 that grants it). Flag every account holding %All — this is the most security-sensitive finding.iris_service_manage action 'list' to enumerate all IRIS services (e.g. %Service_Telnet, %Service_CallIn, %Service_SQL) and their enabled/authentication settings. Flag any service that is enabled but unauthenticated, or that is enabled and not needed (e.g. %Service_Telnet enabled on a production instance).iris_ssl_list to enumerate SSL/TLS configurations. Flag any enabled config with a weak tlsMinVersion (below TLS1.2, bit 16) or missing certificate paths.iris_audit_manage action 'status' to check whether instance auditing is enabled overall and per-event-type.Review and promote configuration/code drift from a source IRIS environment to a target using the review-before-write iris_env_diff -> iris_env_promote workflow (scoped diff, plan, an explicit user-selected step allowlist, confirmed execute, re-diff verify). Never acts on onlyInTarget warnings -- never deletes a target-only item, in any action.
Resend failed Interoperability messages for a config item using the dry-run-first iris_message_resend workflow — preview the match count before executing, then verify the new headers via iris_production_messages. States the duplication hazard and that resend/resendFiltered are governance-default-disabled writes.
Run a full IRIS instance health check (iris_health_check) and interpret every non-ok finding, naming the fixing tool for each one.
Deploy an ObjectScript class or package to IRIS (iris_doc_load, glob-path form), fix compile errors, then run its unit tests (iris_execute_tests) with a total-count check.
Diagnose a slow SQL query using iris_sql_analyze (explain, indexUsage, stats) and recommend a fix — never auto-applies one.
A concise (<=300 word) pre-write checklist distilling the project's ObjectScript conventions ($$$ macros, Quit-in-try/catch, %OnNew/initvalue, no-underscore names, storage sections untouchable, deploy/test discipline).