cx-platform-admin

cx-platform-admin manages access, authentication, and authorization for a Coralogix account through the cx CLI. It covers API key management, custom and system roles, scopes, user administration, team groups, and IP access restrictions. It solves the common admin and security-review need to answer 'who has access', audit permissions, rotate or inventory API keys, review IP allowlists, and add or deactivate users — all through structured, auditable CLI commands rather than ad-hoc console clicks.

A large portion of the skill is devoted to safety. All write operations (create, update, delete, set-status, set-idp) require interactive confirmation, and the skill explicitly forbids passing the `--yes` bypass flag without first describing the exact operation to the user and getting approval. It documents a read-only mode (a flag or environment variable) that blocks all writes at the CLI level for safe exploration, and an agent-mode that fails fast on writes when run inside an AI agent instead of hanging on a prompt. It provides a full access-audit workflow (list users, roles, groups, memberships, API keys, and IP restrictions, then cross-reference), a safe API-key rotation procedure, and explicit warnings that deleting keys breaks integrations, deactivating users is immediate, and removing IP rules can expose the account.

It targets platform administrators, security engineers, and SREs auditing or managing Coralogix IAM. While it does expose genuinely destructive operations (deleting keys, deactivating users, removing IP allowlists), these run against the user's own account via official tooling, are gated behind confirmation, read-only mode, and agent-mode fail-fast, and are framed with strong defensive guidance. There is no exfiltration or offensive behavior.