ms365-tenant-manager
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its data processing workflow.
- Ingestion points: Untrusted data enters via user input (such as company names and roles) and CSV files processed in user_management.py and powershell_generator.py.
- Boundary markers: There are no markers or instructions provided to the agent to treat input data as untrusted or to ignore embedded instructions within that data.
- Capability inventory: The skill produces scripts with significant privileges, including the ability to modify tenant policies, manage user accounts, and audit security logs via Microsoft Graph and Exchange Online modules.
- Sanitization: The Python generator logic uses simple string interpolation (f-strings) to place user input into PowerShell code blocks, providing no protection against command injection payloads that could escape string boundaries.
- [DYNAMIC_EXECUTION]: Multiple modules (powershell_generator.py, tenant_setup.py, user_management.py) generate executable PowerShell scripts at runtime. This dynamic code generation from user-controlled templates represents a security surface that could be exploited if input is not properly validated.
- [REMOTE_CODE_EXECUTION]: The skill's documentation and instructions facilitate the download and execution of external code by requiring the installation of modules from the PowerShell Gallery. While targeting well-known Microsoft repositories, this workflow involves the acquisition and execution of remote components at runtime.
Audit Metadata