Security audit
Security checks for vulnerabilities and agentic risk
This skill performs a disclosed Prisma Access tenant migration workflow using Palo Alto APIs, with sensitive but purpose-aligned access and explicit commit confirmation.
Install only if you intend to let an agent help migrate Prisma Access security configuration. Use least-privilege service accounts, review the dry-run output carefully, and do not approve overwrite or commit actions unless you understand the target-tenant impact.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Each tenant requires its own OAuth2 token:
curl -s -X POST "https://auth.apps.paloaltonetworks.com/am/oauth2/access_token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=${SCM_CLIENT_ID}" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
All exports use:
GET https://api.sase.paloaltonetworks.com/sse/config/v1/{resource}?folder={folder}&limit=200
Handle pagination with offset parameter when total exceeds limit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
After importing, validate by pushing candidate config without committing:
curl -s -X POST "https://api.sase.paloaltonetworks.com/sse/config/v1/config-versions/candidate:push" \
-H "Authorization: Bearer ${TOKEN}" \
-H "Content-Type: application/json" \
-d '{"folders": ["Prisma Access"]}'
No suspicious patterns detected.