m365-entra-attack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill includes code that submits and logs plaintext passwords (e.g., sending "password": password in ROPC requests and Playwright fills) and a report template that records confirmed credentials as ":", which requires the agent to handle and potentially emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document explicitly instructs and provides code to perform unauthorized credential spraying, user enumeration, automated login attempts (ROPC), and post-auth capture (screenshots/cookies), including using leaked credentials and logging partial passwords — clear malicious/abusive intent to gain unauthorized access.