The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides specific HTTP request patterns targeting the Azure Instance Metadata Service (IMDS) at the link-local address 169.254.169.254. These instructions are designed to facilitate the unauthorized retrieval of OAuth tokens for Managed Identities via Server-Side Request Forgery (SSRF).
[PRIVILEGE_ESCALATION]: Detailed instructions are provided for escalating access within Azure and Entra ID. This includes techniques for adding new credentials to existing service principals, abusing high-privilege administrative roles (such as Application Administrator or Privileged Role Administrator), and using the 'roleAssignments/write' permission to grant the attacker elevated resource ownership.
[EXTERNAL_DOWNLOADS]: The skill references several third-party offensive security tools, including AzureHound (a graph-based mapping tool), ScoutSuite (a multi-cloud security auditing tool), and MicroBurst (a PowerShell-based toolkit for Azure assessment). Use of these tools requires downloading and executing code from external repositories.

cloud-azure