attacking-oauth-with-device-code-phishing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs capturing OAuth access/refresh tokens and client secrets and embedding them verbatim into commands/requests (e.g., passing a refresh_token to roadtx or client_secret in a curl POST), which forces the LLM to handle/output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Several URLs point to GitHub repositories that host offensive tooling (TokenTactics, AADInternals, ROADtools) and an attacker callback domain, which are high-risk indicators because they can distribute attack scripts/executables or be used for command-and-control and token exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository contains explicit, actionable instructions and tooling to phish users, capture OAuth access/refresh tokens, redeem refresh tokens for additional resources, and enumerate tenant data — techniques intended to steal credentials and exfiltrate data and therefore represent high-risk malicious behavior when used without explicit authorization.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The agent performs a runtime POST to https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode (and the templated https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode) whose JSON response contains the verification_uri/user_code that the script prints as the operator prompt, so this external URL directly controls agent prompts at runtime.