Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add iblai/enterprise-agents --skill oktagit clone --depth 1 https://github.com/iblai/enterprise-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iblai/enterprise-agents/okta)<a href="https://agentmods.dev/skills/iblai/enterprise-agents/okta"><img src="https://agentmods.dev/badge/skills/iblai/enterprise-agents/okta/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/iblai/enterprise-agents/okta"><img src="https://agentmods.dev/badge/skills/iblai/enterprise-agents/okta.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.00577 |
| Opus 5 | $0.00017 | $0.00289 |
| Sonnet 5 | $0.00007 | $0.00115 |
| Haiku 4.5 | $0.00003 | $0.00058 |
Grade A, and why
okta scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 38 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Okta
What it is
Okta is the leading workforce identity and access management (IAM) platform used by enterprise organizations to manage employee authentication, SSO, and application access. In this segment, agents use Okta to verify who an employee is before routing sensitive requests, check application assignment status for IT support, and confirm MFA enrollment during onboarding. It provides the authoritative directory for user identity across the enterprise.
When to use this skill
- Verifying an employee's identity and role before routing a sensitive HR or IT request
- Looking up a user's group memberships to determine access level or department
- Checking whether a new hire has completed MFA enrollment during onboarding
- Confirming which Okta-managed applications a user is assigned to
- Identifying inactive or locked accounts for IT help desk troubleshooting
Credentials
This skill authenticates using variables from ~/.openclaw/.env (template: .env.example at the config root). Required variables:
OKTA_DOMAIN- Okta organization domain (e.g.mycompany.okta.com)OKTA_API_TOKEN- API token from the Okta Admin Console (Security > API > Tokens)
Key operations
GET /api/v1/users/{userId}- retrieve a user profile by ID or loginGET /api/v1/users?search=profile.email eq "..."- find user by emailGET /api/v1/users/{userId}/groups- list groups a user belongs toGET /api/v1/users/{userId}/factors- list enrolled MFA factorsGET /api/v1/apps/{appId}/users- list users assigned to an applicationPOST /api/v1/users/{userId}/lifecycle/activate- activate a deprovisioned user
Notes
- API tokens have the same permissions as the admin who created them; use a dedicated service account.
- Rate limits: 600 requests/minute for most endpoints; Users API is 600/min, Search is 200/min.
- Okta recommends the Events API (or Okta System Log) for audit trail queries rather than polling user endpoints.
- Never expose
OKTA_API_TOKENin logs; it grants admin-level read access to the entire directory. - Okta Preview (sandbox) uses a separate domain; set
OKTA_DOMAINto the preview org for non-production testing.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 38 lines · 35 tokens per session scan A e7bbb2027548
okta is a skill published in the GitHub repository iblai/enterprise-agents (11 stars, last pushed 3mo ago), licensed MIT. It adds 35 tokens to every session and 577 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
availity
Availity Essentials — lets an agent perform real-time eligibility verification, prior authorization initiation and status checks, and payer enrollment management via the Availity clearinghouse REST API.
cerner-fhir
Cerner Millennium FHIR R4 API — lets an agent read patient clinical data (demographics, encounters, diagnoses, medications, notes) within a Cerner-hosted health system.
epic-fhir
Epic EHR FHIR R4 API — lets an agent read and write patient clinical data (demographics, encounters, diagnoses, medications, notes, orders) within an Epic-hosted health system.
healthstream
HealthStream LMS — lets an agent query employee training transcripts, assign compliance curricula, check credential expiration alerts, and pull completion reports from the HealthStream learning management system.
innovaccer
Innovaccer — lets an agent query population health analytics, patient risk scores, care gap lists, and SDOH screening data from the Innovaccer unified patient data platform.
micromedex
Micromedex (Merative/IBM) — lets an agent perform drug interaction screening, dose range checking, toxicology lookups, and IV compatibility queries using the Micromedex drug knowledge base.