entra-agent-id

ISSUES FOUND max severity HIGHSkillSpector Do not install 56 registry microsoft last scanned 2026-10-22 2 scans

10 findings (1 high, 9 medium), mainly data exfiltration, command injection. Most recent scan 2026-10-22.

Findings10

Critical0

High1

Medium9

Low0

Analyzersstatic bytecode pipeline correlation behavioral trigger

Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 56

Score56 / 100

Issues11

CategoriesData Exfiltration analysis-evasion

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).

Package: 7 files, 48 KB
SKILL.md: 1684 words, 12+ sections
Code: None. Instructions only.
License: MIT

SKILL.md covers: Microsoft Entra Agent ID · Quick Reference · When to Use This Skill · MCP Tools · Before You Start · Conceptual Model · Prerequisites · Required Entra Roles · PowerShell (interactive setup) · PowerShell 7+ · Python (programmatic provisioning) · Authentication

Findings

HIGH Active instruction invokes dynamic code or process execution Command Injectionstatic

SKILL.md contains a syntax-confirmed dynamic code or process execution call in active instructions.

SKILL.md:136

user_id = subprocess.run(

Remediation: Remove dynamic execution, use a fixed allowlisted operation, or isolate non-operative examples in an explicit example section.

MEDIUM Python code block executes shell commands Command Injectionbehavioral

Code block in SKILL.md at line 126 contains potentially dangerous Python code.

SKILL.md:126

user_id = subprocess.run(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in SKILL.md at line 137 contains potentially dangerous Python code.

SKILL.md:137

resp = requests.post(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in SKILL.md at line 155 contains potentially dangerous Python code.

SKILL.md:155

resp = requests.post(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in SKILL.md at line 176 contains potentially dangerous Python code.

SKILL.md:176

resp = requests.post(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in SKILL.md at line 221 contains potentially dangerous Python code.

SKILL.md:221

requests.post(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in SKILL.md at line 239 contains potentially dangerous Python code.

SKILL.md:239

requests.post(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in references/oauth2-token-flow.md at line 38 contains potentially dangerous Python code.

references/oauth2-token-flow.md:38

requests.post(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in references/oauth2-token-flow.md at line 110 contains potentially dangerous Python code.

references/oauth2-token-flow.md:110

resp = requests.post(

Remediation: Review the code block for security implications.

MEDIUM Python code block sends HTTP POST request Data Exfiltrationbehavioral

Code block in references/obo-blueprint-setup.md at line 62 contains potentially dangerous Python code.

references/obo-blueprint-setup.md:62

requests.post(

Remediation: Review the code block for security implications.

What is in the package

File	Kind	Size
`SKILL.md`	doc	16 KB
`references/known-limitations.md`	doc	4.6 KB
`references/oauth2-token-flow.md`	doc	4.4 KB
`references/obo-blueprint-setup.md`	doc	4.1 KB
`references/runtime-token-exchange.md`	doc	6.6 KB
`references/sdk-sidecar-deployment.md`	doc	6.1 KB
`references/sdk-sidecar.md`	doc	6.0 KB

External hosts referenced

graph.microsoft.com learn.microsoft.com login.microsoftonline.com github.com sts.windows.net aka.ms

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

SIDECAR_URL AGENT_CLIENT_ID BLUEPRINT_APP_ID BLUEPRINT_CLIENT_SECRET TENANT_ID

Package contents recorded 2026-10-22 at commit f49ac319a7d3. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Bytecode analyzer.
Pipeline analyzer.
Correlation analyzer.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Scan history

Date	Verdict	Findings	Change	Analyzers	Raw
2026-10-22	HIGH	10	=	static bytecode pipeline correlation behavioral trigger	JSON
2026-10-22	HIGH	10	first scan	static bytecode pipeline correlation behavioral trigger	JSON

Sources

Repository: https://github.com/microsoft/azure-skills
Raw scan result: microsoft-azure-skills-skills-entra-agent-id-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/microsoft-entra-agent-id.svg)
Request a re-scan