菜单
Audit the IRIS instance's security posture: users (default passwords, %All holders), roles, service authentication settings, SSL/TLS configs, and instance auditing status.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Review and promote configuration/code drift from a source IRIS environment to a target using the review-before-write iris_env_diff -> iris_env_promote workflow (scoped diff, plan, an explicit user-selected step allowlist, confirmed execute, re-diff verify). Never acts on onlyInTarget warnings -- never deletes a target-only item, in any action.
Resend failed Interoperability messages for a config item using the dry-run-first iris_message_resend workflow — preview the match count before executing, then verify the new headers via iris_production_messages. States the duplication hazard and that resend/resendFiltered are governance-default-disabled writes.
Run a full IRIS instance health check (iris_health_check) and interpret every non-ok finding, naming the fixing tool for each one.
Deploy an ObjectScript class or package to IRIS (iris_doc_load, glob-path form), fix compile errors, then run its unit tests (iris_execute_tests) with a total-count check.
Diagnose a slow SQL query using iris_sql_analyze (explain, indexUsage, stats) and recommend a fix — never auto-applies one.
A concise (<=300 word) pre-write checklist distilling the project's ObjectScript conventions ($$$ macros, Quit-in-try/catch, %OnNew/initvalue, no-underscore names, storage sections untouchable, deploy/test discipline).
基于 SOC 职业分类
| name | audit-security-posture |
| description | Audit the IRIS instance's security posture: users (default passwords, %All holders), roles, service authentication settings, SSL/TLS configs, and instance auditing status. |
No server profile specified — omit server (or pass "") to use the default server on every tool call below.
This is a READ-ONLY audit — every call below is a read action. Do not modify any user, role, service, or SSL configuration as part of this workflow.
iris_user_get with no name (lists all users). For each enabled user, check: does changePasswordOnNextLogin/expiration look stale or absent, and — for any account you suspect uses a well-known default credential (e.g. _SYSTEM, Admin, SuperUser) — flag it for the user to verify manually (never attempt to test a password via this workflow).iris_role_list to enumerate all roles and their granted resources. Identify every role holding %All (or a resource with unrestricted RWU-style permission) — these are super-user-equivalent roles.roles field for %All (directly, or via a role from step 2 that grants it). Flag every account holding %All — this is the most security-sensitive finding.iris_service_manage action 'list' to enumerate all IRIS services (e.g. %Service_Telnet, %Service_CallIn, %Service_SQL) and their enabled/authentication settings. Flag any service that is enabled but unauthenticated, or that is enabled and not needed (e.g. %Service_Telnet enabled on a production instance).iris_ssl_list to enumerate SSL/TLS configurations. Flag any enabled config with a weak tlsMinVersion (below TLS1.2, bit 16) or missing certificate paths.iris_audit_manage action 'status' to check whether instance auditing is enabled overall and per-event-type.