Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.
$ npx skills add datadog-labs/agent-skills --skill dd-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install datadog-labs/agent-skills dd-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/datadog-labs/agent-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/dd-audit .claude/skills/dd-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "dd-audit" agent skill from https://github.com/datadog-labs/agent-skills/tree/main/dd-audit into .claude/skills/dd-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dd-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/datadog-labs/agent-skills/tree/main/dd-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add datadog-labs/agent-skills --skill dd-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install datadog-labs/agent-skills dd-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/datadog-labs/agent-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/dd-audit .agents/skills/dd-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "dd-audit" agent skill from https://github.com/datadog-labs/agent-skills/tree/main/dd-audit into .agents/skills/dd-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dd-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add datadog-labs/agent-skills --skill dd-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install datadog-labs/agent-skills dd-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/datadog-labs/agent-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/dd-audit .cursor/skills/dd-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "dd-audit" agent skill from https://github.com/datadog-labs/agent-skills/tree/main/dd-audit into .cursor/skills/dd-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dd-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/datadog-labs/agent-skills.git --path dd-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add datadog-labs/agent-skills --skill dd-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install datadog-labs/agent-skills dd-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/datadog-labs/agent-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/dd-audit .gemini/skills/dd-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "dd-audit" agent skill from https://github.com/datadog-labs/agent-skills/tree/main/dd-audit into .gemini/skills/dd-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dd-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install datadog-labs/agent-skills dd-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add datadog-labs/agent-skills --skill dd-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/datadog-labs/agent-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/dd-audit .github/skills/dd-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "dd-audit" agent skill from https://github.com/datadog-labs/agent-skills/tree/main/dd-audit into .github/skills/dd-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dd-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add datadog-labs/agent-skills --skill dd-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install datadog-labs/agent-skills dd-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/datadog-labs/agent-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/dd-audit .opencode/skills/dd-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "dd-audit" agent skill from https://github.com/datadog-labs/agent-skills/tree/main/dd-audit into .opencode/skills/dd-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "dd-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
dd-auditAudit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.
Dd Audit is an agent skill from datadog-labs/agent-skills. Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.
Its SKILL.md is about 970 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Legal & Compliance, covering SOC 2 and security compliance and Root cause analysis. The repository describes itself as: Public repository for Datadog Agent Skills. The licence is MIT.
Read from SKILL.md and the folder at commit 5b40c73. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
jqFrom the folder's file list and the shell code blocks in SKILL.md.
Links to these hosts (documentation or services it may open):
docs.datadoghq.comFrom URLs in SKILL.md, links to its own repository left out.
Names these keys or tokens, usually read from environment variables:
API_KEYDD_API_KEYDD_APP_KEYFrom names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Dd Audit loads about 965 tokens when it runs. Until then it costs about 38 tokens; SKILL.md has 304 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from datadog-labs/agent-skills at commit 5b40c73, republished under its MIT licence (© datadog-labs). 304 words, ~965 tokens.
.claude/skills/dd-audit/SKILL.md (or your agent's skills folder).Investigate user activity, configuration changes, access patterns, and compliance evidence using pup audit-logs.
| Sub-skill | Use when |
|---|---|
| security-investigation | "Who changed X?", "What did this user do?", "Show me deletions in the last 24h" |
| key-compromise | "Was this API key compromised?", "What did key XYZ do?", "Investigate suspicious key activity" |
| cost-spike-investigation | "Why did my bill go up?", "What caused this usage spike?", "Investigate LLM cost increase" |
| compliance-report | "Generate SOC 2 evidence", "PCI audit log", "User provisioning report for auditor" |
| ai-activity-audit | "What did the AI assistant do?", "Audit MCP tool calls", "AI governance report" |
pup auth login # OAuth2 (recommended)
# or set DD_API_KEY + DD_APP_KEY with audit_logs_read scope# List recent events
pup audit-logs list --from 1h --limit 100
# Search with a query
pup audit-logs search --query "@action:deleted" --from 24h
# JSON output for piping to jq
pup audit-logs search --query "@usr.email:alice@example.com" --from 7d -o json | jq '.data[].attributes'| Field | Description | Example values |
|---|---|---|
@usr.email | Actor email | alice@example.com |
@evt.actor.type | How action was taken | USER, API_KEY, SUPPORT_USER |
@action | Verb | created, modified, deleted, accessed, login |
@evt.name | Event category | Dashboard, Monitor, Authentication, Access Management |
@asset.type | Resource type | dashboard, monitor, api_key, role, user |
@asset.id | Resource identifier | abc-123 |
@metadata.api_key.id | API key used (if applicable) | key_abc123 |
@metadata.app_key.id | App key used (if applicable) | app_abc123 |
@network.client.ip | Client IP address | 1.2.3.4 |
@network.client.geoip.country.name | Country | United States |
@network.client.geoip.as.name | ASN name | Amazon.com |
@http.url_details.path | API endpoint path | /api/v1/dashboard/xyz |
Same Lucene-style syntax as Log Explorer:
| Query | Meaning |
|---|---|
@evt.name:Dashboard | Exact field match |
@action:deleted | Action filter |
@usr.email:alice@example.com | Specific user |
@evt.name:Monitor AND @action:modified | Compound |
-@action:deleted | Negation |
@usr.email:* | Field exists |
@network.client.ip:1.2.3.4 | IP filter |
Default retention is 90 days. If querying beyond 90 days, archive to S3/GCS/Azure Blob must be configured. Always check whether the requested time window falls within retention before running a query.
| Problem | Cause | Fix |
|---|---|---|
| 403 Forbidden | Missing audit_logs_read scope | Add scope to app key in Datadog UI |
| Empty results | Time window outside retention | Check archive config; default max is 90 days |
| Timeout | Query too broad | Narrow time window or add more filters |
| No IP data | Internal action or pre-enrichment event | Not all events have geo data |
© datadog-labs, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in dd-audit of datadog-labs/agent-skills.
Open the folder on GitHubat commit 5b40c73
Dd Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Dd Audit this skilldatadog-labs/agent-skills | 177 | — | ~965 | Automated safety check: Pass | MIT | |
| Nist 800 53Sushegaad/Claude-Skills-Governance-Risk-and-Compliance | 942 | 1 repos | ~3.3k | Automated safety check: Pass | MIT | |
| Soc2Sushegaad/Claude-Skills-Governance-Risk-and-Compliance | 942 | 1 repos | ~2.7k | Automated safety check: Pass | MIT | |
| Grc Knowledgemlunato47/claude-grc-plugin | 183 | — | ~6.1k | Automated safety check: Pass | MIT | |
| Information Security Manager Iso27001davila7/claude-code-templates | 32k | 1 repos | ~2.9k | Automated safety check: Pass | MIT | |
| Audit Frameworkscartography-cncf/cartography | 4.1k | — | ~2.8k | Automated safety check: Pass | Apache-2.0 |
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200…
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P).
mlunato47/claude-grc-plugin
Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…
davila7/claude-code-templates
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies.
cartography-cncf/cartography
Audit Cartography's rules and compliance frameworks under cartography/rules/data/rules/.
GRCEngClub/claude-grc-engineering
Builds and deploys a serverless trust center that publishes a company's compliance posture, with gated access to audit reports and an admin dashboard.
datadog-labs/agent-skills
Bootstrap a reproducible LLM Observability experiment through the Python ddtrace SDK or the Node dd-trace SDK.
datadog-labs/agent-skills
Ensure the user has an authenticated Datadog account with a valid DDAPIKEY on the right region before any Datadog setup or instrumentation.
datadog-labs/agent-skills
Entry point for Datadog onboarding. An agent skill from datadog-labs/agent-skills.
datadog-labs/agent-skills
APM - install, onboard, instrument, enable, set up, configure, traces, services, dependencies, performance analysis, Data Streams Monitoring (DSM), queue lag, pipeline latency.
datadog-labs/agent-skills
Install the Datadog Agent on Kubernetes using the Datadog Operator — required before enabling Single Step Instrumentation (SSI), which automatically instruments applications for APM without code…
datadog-labs/agent-skills
Set up the Datadog AWS integration with Terraform - creates the cross-account IAM role Datadog assumes (external ID, no stored credentials), attaches the permission policies Datadog publishes, and…
Categories
Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing. Dd Audit is an agent skill from datadog-labs/agent-skills. Audit Trail investigations - who changed what, key compromise, cost spike root cause, compliance evidence (SOC 2/PCI), and AI activity auditing.
Dd Audit fits situations like: tasks that involve SOC 2 and security compliance; tasks that involve Root cause analysis.
Run `npx skills add datadog-labs/agent-skills --skill dd-audit -a claude-code`. Or copy the skill folder (dd-audit in datadog-labs/agent-skills) into .claude/skills/dd-audit in your project. Claude Code loads it when a task matches its description.
Run `npx skills add datadog-labs/agent-skills --skill dd-audit -a codex`. Or copy the skill folder (dd-audit in datadog-labs/agent-skills) into .agents/skills/dd-audit in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add datadog-labs/agent-skills --skill dd-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/dd-audit, .gemini/skills/dd-audit, .github/skills/dd-audit and .opencode/skills/dd-audit in your project.
Going by SKILL.md and its folder, Dd Audit needs the command-line tools its instructions call (jq) and credentials named API_KEY, DD_API_KEY and DD_APP_KEY. Our summary lists: A credential in DD_API_KEY; A credential in DD_APP_KEY.
SKILL.md names 1 domain. As links in the text: docs.datadoghq.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Dd Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
About 965 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with Dd Audit: Nist 800 53 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 942 stars), Soc2 (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 942 stars), Grc Knowledge (mlunato47/claude-grc-plugin, 183 stars) and Information Security Manager Iso27001 (davila7/claude-code-templates, 32k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
datadog-labs (a GitHub organization) maintains it in datadog-labs/agent-skills, which has 177 GitHub stars. The repository holds 38 skills in this directory. The repository was last updated on October 7, 2026.
Source: datadog-labs/agent-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
