azure-pentesting

该技能与“Azure pentesting”描述一致，但它直接赋予 AI 代理进攻性云渗透、凭据窃取、提权、横向移动、持久化和规避检测能力。未见隐藏安装器或预执行恶意载荷，因此不像伪装型窃密技能；但按 AI Agent Skill 标准，它属于高风险 offensive-security 技能，应视为危险而非普通开发辅助。

This fragment is an explicit Azure post-compromise playbook covering credential theft, data extraction, backdoors, persistence, lateral movement, and detection evasion. It includes a managed-identity token exfiltration example to attacker[.]com, a reference to 169[.]254[.]169[.]254, and a GitHub repository at github[.]com/attacker/runbooks[.]git. The shown material is documentation and does not itself establish that commands execute automatically, but its operational guidance presents a severe security risk if used. Severity: high.

This fragment is not ordinary dependency functionality; it is an operational Azure attack and phishing guide. It documents resource enumeration, anonymous data access testing, password spraying, device-code phishing, and OAuth consent attacks. No executable malware or deliberate code obfuscation is visible, but the documented workflows can directly enable credential theft and unauthorized cloud data access. Use only in an explicitly authorized assessment context.