detect-entra-role-grant-escalation
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements logic to detect specific Entra app-role grant events by processing JSONL input. It performs deterministic data transformation without any external side effects.
- [SAFE]: No network operations, credential handling, or arbitrary command execution patterns were found in the source code.
- [SAFE]: The skill uses standard Python libraries for data processing and hashing, following security best practices for log normalization and detection engineering.
- [SAFE]: External links point to authoritative documentation from Microsoft and the MITRE ATT&CK framework.
Audit Metadata