The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses the subprocess module to execute curl commands for network interactions. The execution uses list-based arguments, which is a secure practice to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to graph.microsoft.com (a well-known service) and a user-specified rp-url to retrieve configuration and registration data for auditing purposes.
[CREDENTIALS_UNSAFE]: The auditing script accepts a Graph API bearer token via the --token command-line argument. While this is standard for CLI tools to authenticate at runtime, passing sensitive tokens as arguments can potentially expose them to other users on the local system through process listing.

implementing-passwordless-authentication-with-fido2