attacking-entra-id

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes many example commands that place passwords, refresh tokens, access tokens, and other secrets directly in command arguments, headers, or flags (e.g., -p 'Password', 'Spring2026!', STOLEN_RT, ACCESS_TOKEN, eyJ0...), which requires the agent to handle or emit secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is explicit offensive tradecraft: it instructs credential theft, token theft/replay, backdoor installation (PTA spy), privilege escalation via service principals/app roles, and other intentional abuse of Entra ID for unauthorized access and persistence.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit commands to extract credentials and install a backdoor/spy on hosts (e.g., Install-AADIntPTASpy, Get-AADIntSyncCredentials, ROADtoken, exporting token-signing cert) which instruct modifying remote system state and require local admin privileges, i.e., guidance to install malware or perform privileged local actions.