hunting-saas-sso-token-abuse
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a well-documented cybersecurity resource for SOC operations, mapping to MITRE ATT&CK T1550.001 (Application Access Token reuse).
- [DATA_EXFILTRATION]: The skill performs network operations to fetch identity logs from Okta and Microsoft Entra ID. These operations target user-defined organizational endpoints (e.g.,
<org>.okta.comandgraph.microsoft.com). No evidence of unauthorized data transmission or hardcoded credentials was found. The use of environment variables for API tokens is a standard safe practice for such tools. - [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes external log data from identity providers. However, this is inherent to its primary purpose as a hunting tool.
- Ingestion points: The
scripts/agent.pyscript ingests JSON log data from the Okta System Log API. - Boundary markers: Absent; the tool is a standalone CLI script designed to process raw log data.
- Capability inventory: The script performs network reads (
requests.get) and optional local file writes for results (--jsonargument). - Sanitization: The script employs schema-based parsing, extracting only specific fields (e.g.,
externalSessionId,ipAddress,userAgent) rather than processing entire log entries as natural language. - [COMMAND_EXECUTION]: The shell commands (
az,curl) and hunting queries (KQL, SPL) provided in the documentation are standard administrative and analysis commands used in professional security contexts.
Audit Metadata