Audit History

Most static alerts are false positives caused by Markdown syntax, OAuth scope strings, official Microsoft endpoints, and bounded configuration examples. One example can forward an agent bearer token to an unrestricted URL, while semantic review found an exposed sidecar port and broad long-lived delegated grants.

No prompt injection, concealed exfiltration, or obfuscated execution was found. Most static hits are markdown formatting, official Microsoft Graph or Entra endpoints, localhost sidecar calls, or OAuth scope strings. Confirmed risks involve Azure client secret handling, privileged Graph mutations, admin consent, bearer token forwarding, and broad delegated grants.

The static findings are mostly false positives from Markdown examples, OAuth scope strings, Microsoft Graph URLs, and localhost sidecar samples. No prompt injection or malicious exfiltration intent was found. Two semantic concerns remain: long-lived delegated grants in examples and reliance on strict sidecar network isolation.

Static analysis reported many command, network, filesystem, credential, and obfuscation patterns, but review found they are in Markdown guidance and sample code for Microsoft Graph and Entra token flows. No prompt injection or malicious exfiltration intent was found. The skill remains medium risk because it guides privileged identity provisioning, token exchange, credential handling, and permission grants.

This is a legitimate Microsoft-authored administrative skill for provisioning Entra Agent Identities. Static findings are primarily documentation patterns (CLI command syntax in backtick notation) and standard Azure credential environment variable usage. All network traffic targets official Microsoft Graph endpoints. No command injection vulnerabilities detected - subprocess calls use hardcoded argument strings. The skill is safe to publish with appropriate documentation.