Versioned security assessment

Report ID: SA-6A3CBFE1

6/28/2026, 9:12:55 AM

ms365-tenant-manager security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ms365-tenant-manager
Version
v4
Maintainer
alirezarezvani
Source
github.com/alirezarezvani/claude-skills/tree/main/engineering-team/ms365-tenant-manager
Coverage
7 Files scanned · 1,867 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill appears intended for legitimate Microsoft 365 administration and no prompt injection or confirmed malicious exfiltration was found. However, it generates privileged PowerShell that performs tenant-wide changes, and several user-controlled values are inserted into double-quoted PowerShell strings without escaping. Static weak-crypto and env-access alerts were dismissed as false positives, while hardcoded Microsoft URLs are low risk.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 1,867 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 5 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 6 evidence locations

Capability review items (4)
High
user_management.py:65-75user_management.py:167-208tenant_setup.py:288-323tenant_setup.py:356powershell_generator.py:49-59powershell_generator.py:330-338
Unescaped Input in Privileged PowerShell Generation
Tenant, user, policy, and license values are inserted into double-quoted PowerShell strings without escaping or validation. If untrusted input contains quotes, newlines, or PowerShell subexpressions, the generated script could be altered before an administrator runs it.
The static command findings are confirmed in semantic context: generated PowerShell embeds input directly into executable script text. The impact is high because the scripts are designed for administrator execution.
High
tenant_setup.py:309-335user_management.py:47-50user_management.py:115-130powershell_generator.py:126-131powershell_generator.py:333-393
Tenant-Wide Administrative Operations Generated by Default
Generated scripts request broad Microsoft Graph, Exchange Online, and Teams permissions and perform tenant-changing operations. This is aligned with the skill purpose, but publication should warn users because mistakes can affect users, licenses, audit settings, and mailbox state across a tenant.
The files clearly generate commands with write scopes and tenant-changing cmdlets. This is probably legitimate, but it is a confirmed high-impact capability.
Medium
user_management.py:177-230HOW_TO_USE.md:174-178
Destructive Offboarding Script Lacks Built-In Dry Run
The offboarding script disables sign-in, revokes sessions, removes group memberships and devices, converts mailboxes, and removes licenses. The documentation recommends dry runs, but this generated offboarding flow does not include a WhatIf or confirmation mode in the shown implementation.
The destructive operations are explicit, and no dry-run guard appears in the relevant offboarding lines. Operational impact is clear even though the intent is normal administration.
Low
HOW_TO_USE.md:220-224SKILL.md:191-195tenant_setup.py:44tenant_setup.py:356
Hardcoded Microsoft Service URLs
The network findings point to Microsoft administration, Graph Explorer, PowerShell Gallery, roadmap, and SharePoint admin URLs. These are expected references for this skill and no evidence of suspicious external collection endpoints was found.
The URLs are visible and all are Microsoft-related service or documentation endpoints. This supports dismissing the static network alerts as low risk.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
powershell_generator.py:155-180powershell_generator.py:203-212powershell_generator.py:231-264
Sensitive Tenant Inventory Written to Local Reports
The generated security audit writes MFA status, admin role assignments, inactive users, guest users, license data, mailbox delegations, and Conditional Access information to CSV files. No network exfiltration was found, but these files can expose sensitive tenant posture if stored or shared carelessly.
The CSV export paths and report contents are directly visible in the generated script. The risk is local data exposure rather than confirmed exfiltration.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
Low
SKILL.md:68-72powershell_generator.py:31-34tenant_setup.py:19-24tenant_setup.py:116-117user_management.py:74-76
Static Weak-Crypto and Env-Access Alerts Dismissed
Weak-crypto alerts correspond to Microsoft 365 security terms such as MFA, passwords, and authentication guidance, not cryptographic code. Env-access alerts correspond to configuration dictionaries, not process environment or secret reads.
Manual review found no hashing, encryption implementation, or environment-secret access at these locations. The terms are documentation or generated admin-script content.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable