Document Splunk Enterprise admin advisor skill

README.md

@@ -10,7 +10,7 @@ make up
 make verify-mcp-remote
 ```
 
-`make up` registers workshop tools **`SA-S4R_*`** on the MCP endpoint (prefer those over ad-hoc SPL). In Cursor: **`/usage`** (tool routing) · **`/demo-prep`** (go/no-go: Splunkbase pins, S4R smoke). Details: [AGENTS.md](AGENTS.md) · [docs/s4r/MCP-TOOLS.md](docs/s4r/MCP-TOOLS.md).
+`make up` registers workshop tools **`SA-S4R_*`** on the MCP endpoint (prefer those over ad-hoc SPL). In Cursor: **`/usage`** (tool routing) · **`/demo-prep`** (go/no-go: Splunkbase pins, S4R smoke) · **`/splunk-enterprise-administration-advisor`** (read-only Enterprise admin guidance). Details: [AGENTS.md](AGENTS.md) · [docs/s4r/MCP-TOOLS.md](docs/s4r/MCP-TOOLS.md).
 
 | URL | Use |
 | --- | --- |

docs/README.md

@@ -19,7 +19,7 @@ Local PoC: **Splunk Enterprise** + **Splunk MCP Server** in Docker, optional **S
 | Install from scratch (long form) | [poc/INSTALLATION.md](poc/INSTALLATION.md) |
 | PoC graduation / wider rollout impact | [poc/GRADUATION.md](poc/GRADUATION.md) |
 | Splunk4Rookies workshop | [s4r/README.md](s4r/README.md) |
-| Change the repo or use AI agents | [AGENTS.md](../AGENTS.md) — Cursor **`/usage`** (`SA-S4R_*` routing) · **`/demo-prep`** (Splunkbase pins + S4R smoke) |
+| Change the repo or use AI agents | [AGENTS.md](../AGENTS.md) — Cursor **`/usage`** (`SA-S4R_*` routing) · **`/demo-prep`** (Splunkbase pins + S4R smoke) · **`/splunk-enterprise-administration-advisor`** (read-only Enterprise admin guidance) |
 | Present the agentic demo (Marp) | [demo-slides/README.md](../demo-slides/README.md) |
 
 ## Source of truth (code wins)

docs/poc/DEVELOPER_GUIDE.md

@@ -15,7 +15,7 @@ Contributing and changing this PoC. Stack design: [ARCHITECTURE.md](ARCHITECTURE
 | `SA-S4R` packaging / `.github/workflows/package-s4r.yml` | [CI_CD.md](CI_CD.md) and [SA-S4R-APP.md](../s4r/SA-S4R-APP.md) |
 | Workshop SPL | [S4R-SPL-CATALOG.md](../s4r/SPL-CATALOG.md) only (agents reference this path) |
 | Agent prompts | `.cursor/agents/s4r-*.md`, [S4R-AGENTS.md](../s4r/AGENTS.md) |
-| Cursor project skills (`/usage`, `/demo-prep`) | `.cursor/skills/*/SKILL.md`, root [AGENTS.md](../../AGENTS.md#cursor-skills-project), and [CONFIGURATION.md § Makefile targets](CONFIGURATION.md#makefile-targets) if command behavior changes |
+| Cursor project skills (`/usage`, `/demo-prep`, `/splunk-enterprise-administration-advisor`) | `.cursor/skills/*/SKILL.md`, root [AGENTS.md](../../AGENTS.md#cursor-skills-project), and [CONFIGURATION.md § Makefile targets](CONFIGURATION.md#makefile-targets) if command behavior changes |
 | Marp slides, theme, or `make marp-*` targets | [demo-slides/README.md](../../demo-slides/README.md), [demo-slides/S4R-DEMO.md](../../demo-slides/S4R-DEMO.md), and [CONFIGURATION.md § Makefile targets](CONFIGURATION.md#makefile-targets) |
 | Secret scanning or pre-commit hooks (`.gitleaks.toml`, `.pre-commit-config.yaml`, CI lint) | [CI_CD.md](CI_CD.md), [SECURITY.md](SECURITY.md), and root [SECURITY.md](../../SECURITY.md) |
 
@@ -65,8 +65,9 @@ Tracked skills live under **`.cursor/skills/`** and are intentionally small, sla
 | ----- | ------ | -------- |
 | `/usage` | Static repo cheat sheet for S4R MCP routing, make targets, and MCP park/boot flow | No live health checks unless the user asks. Keep it concise; point to docs instead of duplicating runbooks. |
 | `/demo-prep` | Live-demo go/no-go: `make demo-prep` (Splunkbase pins + status + verify), S4R MCP smoke, and MCP auth stats | Do not start, clean, or change NK mode unless the user asked. Do not paste secrets. |
+| `/splunk-enterprise-administration-advisor` | Read-only Splunk Enterprise administration guidance for local users, roles, capabilities, configuration precedence, `btool`, service ownership, and maintenance readiness | Advisory only: do not mutate users, roles, config files, app state, indexes, services, or cluster state. Keep source-file, `btool`, and runtime evidence distinct; cite current Splunk Enterprise docs for product behavior. |
 
-Both skill files set **`disable-model-invocation: true`** so their bodies are loaded only when invoked. Keep workshop role behavior in **`.cursor/agents/`** and the SPL in **`docs/s4r/SPL-CATALOG.md`**; skills should route users to those sources rather than becoming another runbook.
+All skill files set **`disable-model-invocation: true`** so their bodies are loaded only when invoked. The Splunk Enterprise administration advisor is vendored from **`splunk/splunk-agent-skills`** with its Apache-2.0 **`LICENSE`** beside the skill; preserve that license if refreshing it. Keep workshop role behavior in **`.cursor/agents/`** and the SPL in **`docs/s4r/SPL-CATALOG.md`**; skills should route users to those sources rather than becoming another runbook.
 
 ## Contributing
 

docs/poc/GRADUATION.md

@@ -130,7 +130,7 @@ These reduce the gap versus a greenfield PoC:
 - **`make clean-y && make up`** for full reset
 - **`make verify`** / **`/demo-prep`** acceptance path
 - **MCP-first** workshop mode (`SA-S4R_*` tools); NK toggle via Splunk config REST (`local/eventgen.conf` override)
-- Tracked **`.cursor/skills/`** (`/usage`, `/demo-prep`)
+- Tracked **`.cursor/skills/`** (`/usage`, `/demo-prep`, `/splunk-enterprise-administration-advisor`)
 - **SA-S4R** package workflow ([CI_CD.md](CI_CD.md))
 - **Cursor Cloud** bootstrap for ephemeral VMs