entra-app-registration
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely educational and documentation-focused, providing guides for Microsoft Entra ID (Azure AD) workflows without including malicious code or hidden instructions.
- [EXTERNAL_DOWNLOADS]: The implementation examples correctly reference official, well-known packages from public registries (NPM, PyPI, NuGet) such as MSAL and Axios. These are documented neutrally as standard requirements for the provided examples.
- [CREDENTIALS_UNSAFE]: The skill uses safe placeholders (e.g., 'YOUR_APPLICATION_CLIENT_ID', 'YOUR_TENANT_ID') for configuration and explicitly includes a 'Security Best Practices' section advising against hardcoding secrets, recommending the use of environment variables and Azure Key Vault.
- [REMOTE_CODE_EXECUTION]: No remote code execution patterns were detected. Code snippets provided are static examples for C#, Python, and Node.js intended for manual implementation by the developer.
- [INDIRECT_PROMPT_INJECTION]: While the skill explains how to interact with the Microsoft Graph API (a potential source of external data), it does so in a development-guidance context. It does not provide automated processing logic that would create an injection surface for the agent itself.
Audit Metadata