The Agent Skills Directory

[SAFE]: The skill performs legitimate security auditing tasks as described in its metadata. No malicious patterns such as prompt injection, obfuscation, or persistence mechanisms were detected.
[COMMAND_EXECUTION]: The skill includes a Python script scripts/agent.py designed to interact with the Microsoft Graph API. It uses the requests library for API calls and the msal library for secure authentication via the client credentials flow.
[DATA_EXFILTRATION]: The agent retrieves configuration and audit data from the Microsoft Graph API, including service principal details and directory audit logs. This data is processed locally and printed to the console for the user, which is the intended behavior for an auditing tool.
[CREDENTIALS_UNSAFE]: The script requires sensitive credentials (Tenant ID, Client ID, and Client Secret) to access the Graph API. It correctly handles these as command-line arguments rather than hardcoding them within the script or documentation, which is a standard and safe practice for CLI-based security tools.

detecting-suspicious-oauth-application-consent