skills/mukul975/anthropic-cybersecurity-skills/detecting-entra-offensive-tools-in-graph-logs/Gen Agent Trust Hub
detecting-entra-offensive-tools-in-graph-logs
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/agent.pyperforms network requests using the standard Pythonurlliblibrary to interact with the Microsoft Azure Monitor Query API atapi.loganalytics.io. This is a standard and expected operation for the skill's purpose of analyzing cloud logs. - [DATA_EXFILTRATION]: The authentication process involves transmitting a user-provided Azure Active Directory bearer token to the well-known Microsoft service domain
api.loganalytics.io. This behavior is consistent with legitimate administrative workflows for querying Log Analytics workspaces and does not involve exfiltration to unknown or untrusted destinations. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it retrieves and processes log entries that may contain attacker-influenced strings. Evidence chain: (1) Ingestion points: Workspace query results from
api.loganalytics.ioinscripts/agent.py; (2) Boundary markers: Absent as the data is used for display purposes; (3) Capability inventory: Network POST requests to a known API and console output; (4) Sanitization: Basic input validation usingargparsetype checking for numerical parameters.
Audit Metadata