sync: auto-sync from GURU-5070 at 2026-06-02 20:40:54

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-06-02 20:40:54

.grok/skills/remediation-tool/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: remediation-tool
+description: >
+  M365 tenant investigation and remediation using the ComputerGuru tiered MSP app suite (Security Investigator, Exchange Operator, User Manager, Tenant Admin, Defender Add-on). Gated writes. Use when the user says "remediation tool", "365 remediation", "check <user> mailbox", "breach check", "tenant sweep", "inbox rules for <user>", or any M365 Graph/Exchange admin task.
+---
+
+# /remediation-tool — M365 Investigation & Remediation
+
+**Grok skill for the shared command.** Full details, safety gates, and the 5-app suite description are in `.claude/commands/remediation-tool.md` and the implementation in `.claude/skills/remediation-tool/`.
+
+**Important posture (from CLAUDE.md and the skill):**
+- Read-only by default.
+- All write/remediation actions are **gated** behind explicit `--confirm` or user approval.
+- Use the skill's structured flows for tenant sweeps, password spray detection, inbox rule enumeration, mailbox searches, etc.
+- NOT for CIPP — this is the direct Graph API app suite (Claude-MSP-Access or equivalent).
+
+When invoked:
+- Read the command doc `.claude/commands/remediation-tool.md`.
+- Read the full skill `.claude/skills/remediation-tool/SKILL.md` (it has the detailed model).
+- Use tools to run the underlying Python/Graph scripts (via `run_terminal_command` after activating the right env/venv if needed).
+- For any credential or token work, go through the vault or 1password skill.
+- Follow all compliance/audit logging requirements in the skill.
+
+This is heavily used in remediation mode. The skill itself is already a proper SKILL.md, so this Grok wrapper mainly ensures `/remediation-tool` shorthand works and points to the source.
+
+See the remediation-tool skill directory for the actual implementation scripts and rules.