Use this skill when asked to investigate a user account for security issues, suspicious activity, or compliance review. Triggers on keywords like "investigate user", "security investigation", "user investigation", "check user activity", "analyze sign-ins", or when a UPN/email is mentioned with investigation context.
Install
npx skills add SCStelz/security-investigator --skill user-investigationnpx skills add SCStelz/security-investigator --skill user-investigation -a claude-code -gnpx skills add SCStelz/security-investigator --skill user-investigation -a codex -ggemini skills install https://github.com/SCStelz/security-investigator.git --path .github/skills/user-investigationgh skill install SCStelz/security-investigator user-investigationgit clone --depth 1 https://github.com/SCStelz/security-investigator /tmp/SCStelz__security-investigator
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/SCStelz__security-investigator/.github/skills/user-investigation ~/.claude/skills/user-investigation # Claude Code
cp -R /tmp/SCStelz__security-investigator/.github/skills/user-investigation ~/.agents/skills/user-investigation # Codex, Cursor, Gemini CLI, Copilot, OpenCode