attacking-entra-id-with-roadtools

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes commands that pass passwords, access/refresh tokens, PRTs and session keys directly on the command line and instruct printing tokens, which requires embedding secret values verbatim in output (high exfiltration risk).

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The documentation and orchestrator explicitly automate Entra ID/Azure AD enumeration, device registration, token/PRT acquisition and refresh-token exchange — deliberate offensive capabilities that enable credential theft, tenant data collection, and privilege pivoting.