Versioned security assessment

Report ID: SA-9E952417

7/24/2026, 3:32:58 AM

entra-agent-id security assessment v5

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
entra-agent-id
Version
v1.0.1
Maintainer
microsoft
Source
github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/entra-agent-id/
Coverage
7 Files scanned · 1,153 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static alerts are false positives caused by Markdown syntax, OAuth scope strings, official Microsoft endpoints, and bounded configuration examples. One example can forward an agent bearer token to an unrestricted URL, while semantic review found an exposed sidecar port and broad long-lived delegated grants.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 1,153 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 49 evidence locations

Filesystem access

May read or write local files.

Observed in 15 evidence locations

Env variables

May read values from the process environment.

Observed in 7 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (1)
High
references/sdk-sidecar-deployment.md:24
Python HTTP libraries
resp = requests.get(endpoint, headers={"Authorization": token}, timeout=10)
The example sends an agent bearer token to an unrestricted endpoint parameter. Untrusted input could redirect the token to an attacker-controlled host.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High
references/sdk-sidecar-deployment.md:99-115references/sdk-sidecar.md:104-113
Authentication Sidecar Published on Host Network
The Docker Compose example publishes sidecar port 5000 as host port 5001. Docker binds published ports broadly by default, exposing unauthenticated token endpoints beyond the private network.
The manifest publishes the sidecar port, while the endpoint reference confirms unauthenticated token acquisition routes. The security section requires local-only access.
RISK-002 Medium
SKILL.md:247-259references/obo-blueprint-setup.md:61-73
Broad, Long-Lived Delegated Permission Grants
Examples create AllPrincipals delegated grants for broad Graph scopes with a ten-year expiry. Copied defaults can provide excessive access across the tenant.
Both examples explicitly combine AllPrincipals consent with broad scopes and a 3650-day expiry. No shorter production default is shown.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    A helper forwards an agent bearer token to any endpoint parameter.
    Require HTTPS and allowlist trusted downstream origins before attaching the Authorization header. Reject redirects to unapproved hosts.
  2. FIX-002
    High
    The Docker Compose example publishes the authentication sidecar on all host interfaces.
    Remove the host port mapping or bind it to 127.0.0.1. Keep unauthenticated token endpoints on a private container network.
  3. FIX-003
    Medium
    Delegated permission examples use AllPrincipals, broad scopes, and a ten-year expiry.
    Use the smallest required scopes, shorten grant duration, document approval, and review each Agent Identity grant regularly.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Content hash
a21b4ddbcaea5c2655ea1ba7593fe3268d07ab9f6a0ca98209f07282f3636cb7
Tree hash
051feea99719e293c0798e8a3646691656394ca2081e847982e1ec47adaeaab1
Skill path
skills/microsoft/entra-agent-id
Audit payload hash
0c7f603d58f4bf5e17e2e8dc89010d2a

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active