The Agent Skills Directory

[COMMAND_EXECUTION]: The orchestrator script scripts/agent.py uses subprocess.run() to execute the roadrecon and roadtx binaries. This functionality is used to automate authentication, directory gathering, and token exchange tasks.
[CREDENTIALS_UNSAFE]: The skill's instructions and the Python wrapper script facilitate passing sensitive credentials, including passwords and authentication tokens, as plaintext command-line arguments. This pattern may result in credential exposure in shell history or system process lists.
[DATA_EXFILTRATION]: The skill enables the extraction of Entra ID directory data (users, groups, roles, and policies) into a local SQLite database for offline analysis. This represents a significant data collection capability, which is the primary intended purpose of the recon tool.
[INDIRECT_PROMPT_INJECTION]: The script scripts/agent.py performs data ingestion by reading from the .roadtools_auth file. 1. Ingestion points: scripts/agent.py reads .roadtools_auth to process authentication tokens. 2. Boundary markers: No explicit boundary markers or instructions to ignore embedded content are used when reading this file. 3. Capability inventory: The skill has access to the local filesystem and the ability to execute shell commands via subprocess.run across all scripts. 4. Sanitization: While the script uses list-based arguments for subprocess calls to prevent shell injection, it does not validate or sanitize the content of the ingested authentication materials.

attacking-entra-id-with-roadtools