feat(uipath-audit): add audit skill#527
Conversation
yadvender-uipath
requested review from
DragosUnguru and
RaduAna-Maria
as code owners
|
Claude finished @yadvender-uipath's task in 3m 29s —— View job PR Review: feat(uipath-audit): add audit skill
SummaryAdds a new Change-by-Change Review1.
|
| Area | Status | Notes |
|---|---|---|
| Frontmatter | Issue | [PREVIEW] prefix violates naming rules — High |
| E2E Tests | OK | 2 smoke + 1 e2e, proper tags, strong success criteria |
| Skill Body | OK | Well-structured, prescriptive, good anti-patterns |
| References & Assets | OK | Thorough command ref + 4-investigation workflow guide. Minor duplication with Key Concepts in SKILL.md |
| Repo Hygiene | OK | CODEOWNERS updated, no secrets, no cross-skill refs, hook change is minimal |
Issues for Manual Review
- CLI command accuracy: The reviewer cannot verify whether
uip admin audit org|tenant {sources|events|export}flags, output shapes, and error codes match the actual CLI implementation in UiPath/cli#1372. Domain owners should confirm the command surface is accurate. - Trigger scope overlap: Verify the description doesn't false-trigger on general "who did X" questions that aren't UiPath-related. The
→uipath-gov-aops-policyredirect handles the governance sibling, but broad investigation-intent phrases ("who deleted X") could potentially match non-UiPath contexts. - Sequencing: As noted in the PR, the skill assumes
uip admin auditcommands exist in the published@uipath/cli. Runtime will fail until UiPath/cli#1372 ships.
Conclusion
Strong first skill. Clean structure, thorough references, and good test coverage. One High issue blocks merge: the [PREVIEW] prefix in the frontmatter description must be removed per repo rules (preview status goes in the body). One Medium duplication finding is worth addressing to keep the SKILL.md lean. Everything else looks good — approve after fixing the frontmatter.
yadvender-uipath
force-pushed
the
feat/add-uipath-audit-skill
branch
from
2f2f6b8 to
12360ee
Compare
yadvender-uipath
requested review from
AlvinStanescu,
dmetzgar,
gabrielavaduva,
gozhang2,
marius-bughiu,
rockymadden and
uipreliga
as code owners
|
Claude finished @yadvender-uipath's task in 3m 16s —— View job Coder-eval task lint (advisory)3 task YAMLs changed; verdicts: 0 Critical, 3 High, 0 Medium, 0 Low, 0 OK. Rubric: .claude/commands/lint-task.md. This check is advisory and never blocks merge. Evidence of passing run❌ High — PR body does not claim the changed tasks have been run and passed. The test plan shows unchecked boxes for Themes
Per-task lint
|
yadvender-uipath
force-pushed
the
feat/add-uipath-audit-skill
branch
from
12360ee to
56ebd7c
Compare
|
Claude finished @yadvender-uipath's task in 2m 26s —— View job Coder-eval task lint (advisory)3 task YAMLs changed; verdicts: 0 Critical, 3 High, 0 Medium, 0 Low, 0 OK. Rubric: .claude/commands/lint-task.md. This check is advisory and never blocks merge. Evidence of passing run❌ High — PR body does not claim the changed tasks have been run and passed. The test plan shows unchecked boxes for Themes
Per-task lint
|
Skill teaches agents how to drive `uip admin audit org|tenant {sources|events|export}`
from natural-language audit / investigation prompts. Mirrors the structure of the
existing uipath-gov-aops-policy skill.
Adds:
- skills/uipath-audit/SKILL.md
- skills/uipath-audit/references/audit-commands.md
- skills/uipath-audit/references/audit-workflow-guide.md
- tests/tasks/uipath-audit/{audit_sources_smoke,audit_events_pagination_smoke,audit_export_e2e}.yaml
- CODEOWNERS entry
Drive-by: hooks/ensure-uip.sh now respects SKIP_UIP_AUTO_INSTALL=1 so
contributors developing CLI features against a `bun link`'d workspace
binary don't have their link clobbered every session.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
yadvender-uipath
force-pushed
the
feat/add-uipath-audit-skill
branch
from
56ebd7c to
eeebd46
Compare
| --type <DELETED_FOLDER_TYPE_GUID> \ | ||
| --from-date 2026-04-22T00:00:00Z \ | ||
| --to-date 2026-04-29T00:00:00Z \ | ||
| --limit 50 \ |
There was a problem hiding this comment.
How does pagination work?
| --- | ||
| name: uipath-audit | ||
| description: "UiPath audit events — list sources, query events with cursor pagination, and export ZIPs from the long-term store via `uip admin audit org|tenant {sources|events|export}`. For governance policies→uipath-gov-aops-policy." | ||
| allowed-tools: Bash, Read, Write, Grep, Glob |
There was a problem hiding this comment.
Might want AskUserQuestion
| @@ -0,0 +1,232 @@ | |||
| --- | |||
| name: uipath-audit | |||
| description: "UiPath audit events — list sources, query events with cursor pagination, and export ZIPs from the long-term store via `uip admin audit org|tenant {sources|events|export}`. For governance policies→uipath-gov-aops-policy." | |||
There was a problem hiding this comment.
Might want to add Always invoke...
uipreliga
left a comment
uipreliga
left a comment
There was a problem hiding this comment.
can you fix the test issues?
| Platform note: runs without an authenticated tenant — commands will | ||
| fail with auth errors. That is acceptable; what matters is correct | ||
| command invocation with correct flags. | ||
| tags: [uipath-audit, smoke, events] |
There was a problem hiding this comment.
also add the mode:build (check the tags in tests/README.md)
| "to": "<the --to-date value>", | ||
| "limit": <the --limit value, as a number>, | ||
| "commands_used": ["<list of uip commands you attempted>"] | ||
| } |
There was a problem hiding this comment.
let's not do self reporting - that's an anti-pattern. tell it to save info to the file and use python or llm-as-ajudge to check if it is correct.
| minimum: | ||
| { |
There was a problem hiding this comment.
as above - no self-reporting.
3 participants
Summary
Adds a self-contained agent skill that teaches Claude Code / Codex CLI / Gemini CLI / Cursor / Copilot how to drive
uip admin audit org|tenant {sources|events|export}from natural-language audit and investigation prompts ("who deleted X", "show me failed logins", "give me an audit dump for January").Mirrors the structure of the existing
uipath-gov-aops-policyskill — single SKILL.md entry point, two reference docs for the command surface and the investigation playbook, eight test tasks (5 smoke + 3 e2e) covering single-action verification and full multi-step investigations.Companion to the CLI side at https://github.com/UiPath/cli/pull/1372 (the new
uip admin audit ...commands themselves). Skill PR is sequenced after the CLI PR ships and the published@uipath/cliincludes the audit commands.What's added
Skill behavior highlights
> **Preview**callout under the H1 (matches the convention used byuipath-coded-apps,uipath-data-fabric,uipath-governance,uipath-human-in-the-loop,uipath-interact,uipath-maestro-case,uipath-rpa-legacy). The frontmatterdescriptionstarts withUiPath(no[PREVIEW]prefix) per.claude/rules/skill-structure.md."export the audit log") and no prior turn has established it, the skill asks one question (org vs tenant + which tenant) before running anything. Skips the question only when scope is explicit, established earlier in the conversation, or trivially implied by login context.next= newer,previous= older) and explicitly tells agents to bump--limitrather than chase cursor flags manually (the CLI tool paginates internally for--limit > 200).audit-dowload-from-longterm-store.sh. Skill warns that per-day files inside the ZIP are JSON-as-.txtwith PascalCase keys (different from the camelCase liveeventsshape).Reference doc fidelity
Both reference docs were tightened against the actual CLI implementation:
audit-commands.md--to-datedocumented as "Inclusive of the exact instant" with guidance to pass the start of the next day (orT23:59:59.999Z) to capture a full final day — matchesdayChunksclamping behavior.--statusdocuments both label and numeric forms (<Success|Failure|0|1>).--limitdocuments the omitted-value behavior (server default page).AuditEventDtoexample includes all 16 real fields includingorganizationName,tenantName, and the nestedclientInfo: { ipAddress, ipCountry }block that Investigation 2 (login history) relies on.audit-workflow-guide.md<inner>_<outer>.txtrename) and same-name collisions (_<YYYY-MM-DD>suffix).Identity/Authentication/User Loginare illustrative names — agents should confirm against actualsources.jsonand fall back to listing candidates withjq -r '.Data[].name'.Sample agent prompts the skill should handle
events --user-id … --type … --status Failure --from-date … --to-date …sourcesdiscovery →events --source … --target …export --from-date 2026-01-01 --to-date 2026-02-01 --output-file …org events --from-date … --to-date … --limit 100Multi-tool support — automatic
The skill body is plain markdown, no agent-specific tool names. Each agent picks it up via repo-level wiring that already exists, no per-skill changes needed:
.claude-plugin/plugin.jsondeclares"skills": "./skills/".agents/skills/symlink to../skills/.agents/skills/discovery +.gemini/settings.jsoncontext loading.cursor/rules/*.mdcrepo-level rules cover skill discoveryAGENTS.mdsymlink toCLAUDE.mdDrive-by improvement
hooks/ensure-uip.shnow respectsSKIP_UIP_AUTO_INSTALL=1. Contributors developing CLI features against abun link'd workspace binary kept losing their link every Claude session because the SessionStart hook would re-install the published@uipath/clion top of it. With the env var set, the hook exits cleanly without touching the global binary. Other plugin hooks (suggest-permissions.sh) and the npm-install path for normal users are unaffected. Three lines, gated behind an explicit opt-in, no behavior change for anyone not setting the var.If reviewers prefer this as a separate PR, happy to extract — flagging it explicitly so it's not buried.
Test plan
bash hooks/validate-skill-descriptions.sh) → exit 0python -c "import yaml; yaml.safe_load(...)"references/make smoke -- --filter uipath-auditcovering all 5 smoke tasks (will run in CI)make e2e -- --filter uipath-auditcovering all 3 e2e tasks (daily CI)audit <scope> export --from-date 2026-01-01 --to-date 2026-02-01 --output-file …Sequencing note
Skill assumes the CLI commands exist (
uip admin audit ...). It will fail at runtime against a published@uipath/clithat predates UiPath/cli#1372. Suggest holding this PR's plugin-version bump until that CLI PR is merged and a published version is out — though the skill itself can land sooner since it's a no-op for users without the audit commands.🤖 Generated with Claude Code