sota-identity-access SKILL.md skillA
sota-identity-access from martinholovsky/sota-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add martinholovsky/sota-skills/sota-identity-access@git:20261024.a79cfafPins git:20261024.a79cfaf in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- martinholovsky/sota-skills
- Path
skills/sota-identity-access/SKILL.md- Versions recorded
- 8
- Latest version
- git:20261024.a79cfaf, committed Oct 24, 2026
- First version recorded
- Jun 17, 2026
- Size
- 14,744 bytes
- Repository stars
- 26
- License
- CC-BY-4.0
State-of-the-art identity and access management engineering (2026) for BUILDING/configuring identity infrastructure AND AUDITING it — federation, IdPs, authorization models, the joiner-mover-leaver lifecycle, privileged/break-glass access, workload identity, MFA/passkeys, and assurance levels; audits cover orphaned accounts, over-privileged roles, weak MFA, long-lived tokens, and SAML misconfig. Owns identity INFRASTRUCTURE and access-management DESIGN, not app-level login/session/JWT…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# SOTA Identity & Access ## Purpose Own the identity **infrastructure** and access-management **design** of a system: the federation protocols themselves, the IdP that issues and validates tokens, the authorization model that decides who may do what, the lifecycle that creates and destroys access, privileged access, and machine identity. Two modes. In **BUILD** mode you stand up or configure this infrastructure correctly by default. In **AUDIT** mode you assess an existing identity estate against the same rules and report severity-rated findings. The rules files are the single source of truth for both. Boundary discipline — this skill does **not** re-teach what siblings own: - **App-level authn ceremony** (password storage/argon2id, session cookie flags, WebAuthn ceremony, JWT *signature* validation mechanics at one RP): that is **[sota-code-security** rules/02](../sota-code-security/rules/02-authentication.md) (sessions and JWT: [rules/17](../sota-code-security/rules/17-sessions-and-tokens.md)). This skill owns the protocol and the IdP side. - **App-level object/function authz** (IDOR/BOLA in one service's handlers): that is …
Read the whole file at its exact version.
How to install
mdr add martinholovsky/sota-skills/sota-identity-access@sha256:c95a61866747732dThe line at the top of this page pins the label git:20261024.a79cfaf, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_t4q5pc7gdwt4jvvj)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 8 versions of this file, between Jun 17, 2026 and Oct 24, 2026, about one every 19 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261024.a79cfaf latest | 2026-10-24 | a79cfaf | 14,744 B | A | view · diff |
| git:20261024.8dd2b0a | 2026-10-24 | 8dd2b0a | 14,633 B | A | view · diff |
| git:20261012.ae1b29b | 2026-10-12 | ae1b29b | 14,280 B | A | view · diff |
| git:20260925.467e225 | 2026-09-25 | 467e225 | 13,169 B | A | view · diff |
| git:20260925.054c2cb | 2026-09-25 | 054c2cb | 12,549 B | A | view · diff |
| git:20260704.67df0cc | 2026-07-04 | 67df0cc | 12,520 B | A | view · diff |
| git:20260629.bacf523 | 2026-06-29 | bacf523 | 11,831 B | A | view · diff |
| git:20260617.c5d2c7b | 2026-06-17 | c5d2c7b | 12,479 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (14744 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
martinholovsky/sota-skills · 26 stars · license CC-BY-4.0 · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_t4q5pc7gdwt4jvvj GET https://markdownregistry.com/api/v1/resolve?ref=martinholovsky/sota-skills/sota-identity-access GET https://markdownregistry.com/api/v1/blob/c95a61866747732d78b548fd23266a77ac93cd171caabb160b91faa3920196c4
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.