The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides two comprehensive automation scripts:
A Python script for ROPC (Resource Owner Password Credentials) validation that automates authentication requests to Microsoft's OAuth endpoints.
A Playwright script for SAML SSO validation that performs browser-based automation to bypass or validate Conditional Access (CA) blocks.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install third-party security tools from public registries without integrity verification, specifically msftrecon and o365spray via pip, as well as the ProjectDiscovery toolkit via Go.
[DATA_EXFILTRATION]: The provided automation scripts implement local logging of attack states, including email addresses, validation statuses, and attempt counters, to files like engagement_log/o365_attempts.json and o365_results.jsonl.
[CREDENTIALS_UNSAFE]: The Python validation script explicitly disables SSL/TLS certificate verification by setting ssl.CERT_NONE and check_hostname=False. This critical security flaw exposes the agent to Man-in-the-Middle (MITM) attacks, allowing an attacker to intercept the credentials being sprayed. Additionally, the skill includes a list of common corporate password patterns to facilitate guessing attacks.

m365-entra-attack