The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/process.py uses subprocess.run to execute Azure CLI (az) commands. While the arguments are defined within the script's audit logic rather than direct user input, this facilitates system-level command execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Microsoft Graph API and Azure AD logs and includes it in audit reports.
Ingestion points: External data is ingested in scripts/agent.py and scripts/process.py from Entra ID API responses and CLI outputs.
Boundary markers: The skill lacks boundary markers or instructions to disregard potentially malicious content within the logs.
Capability inventory: The skill can perform network operations to Microsoft identity endpoints and write data to the local file system.
Sanitization: No sanitization or escaping is applied to ingested fields like service principal names before they are reported.

detecting-azure-service-principal-abuse