Versioned security assessment

Report ID: SA-7C989FE1

6/30/2026, 7:58:34 AM

entra-agent-id security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
entra-agent-id
Version
v2
Maintainer
microsoft
Source
github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/entra-agent-id/
Coverage
7 Files scanned · 1,153 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many command, network, filesystem, credential, and obfuscation patterns, but review found they are in Markdown guidance and sample code for Microsoft Graph and Entra token flows. No prompt injection or malicious exfiltration intent was found. The skill remains medium risk because it guides privileged identity provisioning, token exchange, credential handling, and permission grants.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 1,153 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 73 evidence locations

Filesystem access

May read or write local files.

Observed in 15 evidence locations

Env variables

May read values from the process environment.

Observed in 7 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 268 evidence locations

Capability review items (4)
Medium
SKILL.md:147-151SKILL.md:231-239SKILL.md:249-259
Privileged Microsoft Graph Identity Operations
The skill provides examples for creating Agent Identity Blueprints, BlueprintPrincipals, Agent Identities, app role assignments, and delegated permission grants. This is legitimate for the skill purpose, but misuse can create identities or grant Microsoft Graph permissions with broad tenant impact.
The cited examples directly call Microsoft Graph endpoints that create resources or grant permissions. Context shows administrative setup guidance, not malicious behavior, so the risk is operational rather than hostile.
Medium
SKILL.md:111-116references/oauth2-token-flow.md:100-105references/sdk-sidecar-deployment.md:107-115
Credential Handling Examples Require Careful Use
The skill shows Azure credential environment variables, client secret creation, and sidecar secret configuration. These patterns are expected for Entra setup, but users could leak secrets if copied into logs, code, or insecure deployment manifests.
The files clearly discuss real client secrets and environment-based credentials. The same files recommend production alternatives, which lowers confidence that this is unsafe by design.
Medium
references/sdk-sidecar.md:108-112references/sdk-sidecar-deployment.md:180-185SKILL.md:323
Unauthenticated Sidecar Endpoints Must Stay Local
The AgentID sidecar documentation includes unauthenticated token endpoints for local companion-container use. The deployment guidance warns not to expose the SDK publicly, but a user who publishes it through ingress or a load balancer could expose token acquisition functionality.
The endpoint table explicitly marks unauthenticated endpoints, and the deployment file documents the required containment. The risk depends on deployment choices, so this is a medium-confidence operational concern.
Low
SKILL.md:118-123references/runtime-token-exchange.md:19references/sdk-sidecar.md:119-125
Hardcoded URLs Are Expected Microsoft Endpoints
Hardcoded network locations point to Microsoft Learn, Microsoft Graph, login.microsoftonline.com, GitHub documentation, localhost, or container images. These endpoints match the stated Entra Agent Identity workflow and do not indicate data exfiltration.
The reviewed URLs are first-party Microsoft identity endpoints or documentation links. No suspicious third-party collection endpoint was found.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:76-81SKILL.md:132-139references/known-limitations.md:28-29
Static Command Execution Alerts Are Documentation Examples
Most external command detections are Markdown code fences or inline command references for installing modules, Azure CLI lookup, PowerShell Graph requests, and troubleshooting. They are not hidden executable skill logic and do not run automatically.
The reviewed locations are visible Markdown examples and prose. There is no script file, hook, or automatic execution path in the skill structure.
Low
references/known-limitations.md:33references/runtime-token-exchange.md:157-158references/oauth2-token-flow.md:67-73
Static Sensitive-File and Weak-Crypto Alerts Are Mostly False Positives
The Windows SAM alert appears to match the term SAML in authentication documentation, and weak-crypto alerts appear tied to OAuth terminology such as client secrets or RFC identifiers. These are not evidence of local secret theft or unsafe cryptographic implementation.
The cited text is identity documentation and JWT validation guidance. I found no evidence of access to Windows SAM files or custom weak cryptographic code.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable