A drop-in like deploy ALL=(root) NOPASSWD: /usr/bin/vim /etc/nginx/nginx.conf looks limited, but :!sh inside vim is a root shell with no password. /bin/cat /var/log/* also lets a user read /var/log/../../etc/shadow, and Defaults env_keep += "LD_PRELOAD" turns any command a user may run into root code execution. This skill finds those and other sudoers mistakes before the rules are installed, and tells you how to fix each one.

Your agent runs a scanner on your sudo rules: /etc/sudoers, every file in sudoers.d, sudoers templates (sudoers.j2 and similar) and files such as sudoers_deploy in Ansible roles or image builds. It reads them the way sudo does: comments and #uid user IDs, backslash line continuations, User, Runas, Host and Cmnd aliases (also across files), Defaults bound to users, hosts or commands, NOPASSWD and other tags that carry over to later commands, "" for no arguments and ^...$ regular expressions. Rules that only root gets and commands run as a user other than root are not flagged for root access, and the default sudoers files of Debian, Ubuntu, Fedora, RHEL, Arch Linux, openSUSE and macOS give NOT FLAGGED. It never runs sudo or visudo. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• U01: NOPASSWD: ALL (directly, through a Cmnd_Alias or carried over from an earlier command), or ALL with the password turned off by Defaults !authenticate

• U02: commands allowed without a password that open a root shell or write any file: editors, pagers, man and git with any arguments; crontab -e, systemctl edit and kubectl edit; shells, interpreters, find, tar, rsync, docker, kubectl, systemctl, cp, tee and package managers with open or wildcard arguments; interactive shells and su to root

• U03: wildcards in command arguments, regular expressions with .*, paths such as /usr/bin/* and folders ending in /

• U04: commands, scripts or installer files (pip install -r, dpkg -i) in home folders, /tmp, /var/tmp or /dev/shm

• U05: env_keep with LD_PRELOAD, LD_LIBRARY_PATH, PYTHONPATH, PERL5LIB, NODE_OPTIONS and similar variables; the SETENV tag; Defaults setenv

REVIEW (check before release)

• U11: Defaults !authenticate

• U12: Defaults !env_reset

• U13: secure_path missing (while users get limited command rules), turned off, or listing a user-writable folder or "."

• U14: timestamp_timeout above 15 minutes or negative, timestamp_type=global, !tty_tickets

• U15: rules for ALL users or for %users and %everyone (not when Defaults targetpw, rootpw or runaspw asks for the target's password)

• U16: the same shell-escape commands as U02 when a password is asked

• U17: commands subtracted from ALL (ALL, !/bin/su)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example /etc (sudoers, a cloud-init drop-in, deploy and helpdesk rules), and the real report the scanner produces on the risky one

Limits

It reads rule text: host restrictions, group membership, #include files outside the scanned folder, file ownership and the installed sudo version are not checked, and template logic (Jinja, ERB) is skipped. Rules written inside other files (Ansible lineinfile, cloud-init sudo: keys, LDAP sudoRole entries) are not read. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 14 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.