Skills entra-app-registration Audit History

📦

Audit History

entra-app-registration - 6 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v6 Latest	Jul 23, 2026, 08:03 PM	9 confirmed	9	No capability change
v5	Jul 8, 2026, 05:30 AM	1 confirmed	0	No capability change
v4	Jul 5, 2026, 10:57 PM	1 confirmed	0	No capability change
v3	Jul 5, 2026, 10:57 PM	1 confirmed	0	No capability change
v2	Jun 30, 2026, 08:01 AM	No confirmed findings	4	External commandsNetwork accessFilesystem accessEnv variables
v1	Feb 20, 2026, 08:51 AM	No confirmed findings	0	Baseline

Audit version 6 Latest

Jul 23, 2026, 08:03 PM

Most static alerts are lexical false positives caused by Markdown, Microsoft endpoints, OAuth scopes, and explicit Azure administration examples. Confirmed risks include unsafe placeholder redirects, credential-reset commands, and an unguarded cleanup loop. Semantic review also found a source-embedded secret pattern, broad default Graph permissions, and overbroad public-client guidance.

Files scanned

2,802

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (9)

High

references/console-app-example.md:311

Client Secret Embedded in Source Example

The Node.js example places the client secret directly in source configuration. Users who replace the placeholder may commit a live credential to version control.

The clientSecret field is explicitly populated from an app-registration placeholder inside source code. The surrounding example provides no secure retrieval pattern.

High

references/BICEP-EXAMPLE.bicep:121-146

Overprivileged Default API Permissions

The deployable Bicep example requests Mail.Read and application-level User.Read.All by default. An approved deployment can expose mailbox and directory data beyond basic sign-in needs.

The permission IDs and comments directly configure delegated mail access and tenant-wide application user access. These permissions are unrelated to a minimal registration baseline.

Medium

references/cli-commands.md:138

System reconnaissance

az ad app credential reset --id $APP_ID

The command resets credentials without --append, and the guide states that this deletes existing credentials. Running it can immediately break every client using those credentials.

Medium

references/cli-commands.md:141

System reconnaissance

az ad app credential reset --id $APP_ID --years 1

The one-year secret command resets credentials without --append. It can invalidate all existing application credentials and cause an authentication outage.

Medium

references/cli-commands.md:144

System reconnaissance

az ad app credential reset --id $APP_ID --end-date "2025-12-31"

The dated secret command resets credentials without --append. It can invalidate existing clients before they migrate to the new credential.

Medium

references/cli-commands.md:180

System reconnaissance

az ad app credential reset --id $APP_ID --cert "@path/to/cert.pem"

The certificate upload uses credential reset without --append. It can remove existing passwords and certificates, causing service disruption.

Medium

references/cli-commands.md:407

System reconnaissance

az ad app delete --id $APP_ID

This line deletes every application returned by a pattern-based cleanup loop without confirmation. A broad match can remove valid identity applications and interrupt authentication.

Medium

references/troubleshooting.md:70

System reconnaissance

az ad app credential reset --id $APP_ID --years 1

The troubleshooting fix resets all application credentials without warning or --append. Applying it can invalidate active clients while resolving one expired secret.

Medium

references/first-app-registration.md:97-100

Overbroad Public Client Flow Enablement

The beginner guide tells every console app to enable public client flows, including resource owner password flow. This expands the authentication surface without confirming the required flow.

The text explicitly identifies resource owner password flow and directs console-app users to enable the setting. It does not limit the advice to device-code requirements.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/BICEP-EXAMPLE.bicep:21

Hardcoded URL

'https://myapp.azurewebsites.net/signin-oidc'

This deployable template registers a non-reserved external hostname as a default web redirect URI. An unchanged deployment could direct authorization responses to a domain outside the user's control.

Medium

references/BICEP-EXAMPLE.bicep:27

Hardcoded URL

'https://myapp.azurewebsites.net'

This deployable template registers a non-reserved external hostname as a default SPA redirect URI. An unchanged deployment could expose authorization responses to another domain.

Medium

references/BICEP-EXAMPLE.bicep:56

Hardcoded URL

logoutUrl: 'https://myapp.azurewebsites.net/signout-oidc'

The executable template sets an unverified external logout URL by default. An unchanged deployment can redirect signed-out users to a domain outside their control.

Medium

references/cli-commands.md:31 references/cli-commands.md:55

Hardcoded URL · 2 occurrences

--web-redirect-uris "https://myapp.com/callback" \

This executable example registers myapp.com as an OAuth callback without requiring replacement. Copying it unchanged could authorize redirects to a domain the user does not control.

Medium

references/cli-commands.md:117

Hardcoded URL

--web-redirect-uris "https://myapp.com/callback" "https://myapp.com/auth"

This update command adds external myapp.com callback URLs to an existing registration. Running the example unchanged creates redirect destinations outside the user's verified domains.

Medium

references/cli-commands.md:129

Hardcoded URL

--public-client-redirect-uris "http://localhost" "myapp://auth"

The command registers a generic custom URI scheme that another local application could claim. Native clients should use protected app links or carefully validated loopback redirects.

Medium

references/troubleshooting.md:41

Hardcoded URL

--web-redirect-uris "http://localhost:3000" "https://myapp.com/callback"

This remediation command registers myapp.com as a live callback without a replacement check. Copying it unchanged can introduce an unauthorized redirect destination.

Low

references/BICEP-EXAMPLE.bicep:55

Hardcoded URL

homePageUrl: 'https://myapp.azurewebsites.net'

The executable template assigns an unverified external hostname as application metadata by default. Users may publish a link they do not control if they deploy it unchanged.

Risk Factors

🌐 Network access (50)

📁 Filesystem access (18)

references/api-permissions.md:60 references/api-permissions.md:61 references/console-app-example.md:318 references/first-app-registration.md:184 references/oauth-flows.md:181 references/oauth-flows.md:187 references/oauth-flows.md:188 references/oauth-flows.md:189 references/sdk/azure-identity-dotnet.md:11 references/sdk/azure-identity-dotnet.md:19 references/sdk/azure-identity-java.md:17 references/sdk/azure-identity-java.md:25 references/sdk/azure-identity-py.md:13 references/sdk/azure-identity-py.md:21 references/sdk/azure-identity-ts.md:11 references/sdk/azure-identity-ts.md:19 references/sdk/azure-keyvault-py.md:18 references/sdk/azure-keyvault-secrets-ts.md:18

⚙️ External commands (30)

🔑 Env variables (14)

Detected Patterns

System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissance

Audited by: codex

Audit version 5

Jul 8, 2026, 05:30 AM

Static findings were reviewed as documentation and examples for Microsoft Entra app registration. The hardcoded URLs, OAuth .default scopes, environment variable examples, and prompt-related hits are false positives. One medium operational risk remains because several CLI examples can change or delete tenant objects if copied without review.

Files scanned

2,802

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

references/cli-commands.md:231-235 references/cli-commands.md:318-322 references/cli-commands.md:399-407

Tenant-changing command examples need stronger guardrails

The CLI reference includes admin consent, credential reset, owner change, and deletion examples. These commands fit the skill purpose, but copied commands can change or delete tenant objects without an explicit confirmation step.

The referenced CLI guide clearly contains tenant-affecting operations. They are transparent examples, so the risk is operational misuse rather than malicious intent.

Risk Factors

🌐 Network access (70)

📁 Filesystem access (18)

⚙️ External commands (30)

🔑 Env variables (14)

Audited by: codex

Audit version 4

Jul 5, 2026, 10:57 PM

Static analysis produced many alerts, but review found they are mostly Markdown examples for Microsoft Entra, OAuth, Azure CLI, and SDK usage. No prompt injection, credential exfiltration, or hidden execution was found. The main residual risk is that privileged Azure CLI examples can modify a tenant if an agent or user runs them without review.

Files scanned

2,657

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

references/cli-commands.md:136-180 references/cli-commands.md:231-235 references/cli-commands.md:304-322 references/cli-commands.md:399-407

Privileged Azure CLI Examples Require Explicit Confirmation

The skill includes examples that can reset app credentials, grant admin consent, change ownership, or delete app registrations. These are legitimate administration examples, but agents should not execute them without explicit user approval and tenant validation.

The cited Azure CLI examples directly perform credential, consent, owner, and delete operations. They are transparent examples, so the risk is operational misuse rather than hidden malicious behavior.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

High

references/console-app-example.md:183

System prompt extraction attempt

# Display instructions to user

Force-confirmed blocker/high static finding; AI dismissal overridden.

High

references/oauth-flows.md:247

System prompt extraction attempt

#### 2. Display Instructions to User

Force-confirmed blocker/high static finding; AI dismissal overridden.

Risk Factors

🌐 Network access (70)

📁 Filesystem access (8)

⚙️ External commands (24)

🔑 Env variables (1)

references/sdk/azure-identity-py.md:24

Audited by: codex

Audit version 3

Jul 5, 2026, 10:57 PM

Files scanned

2,657

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

references/cli-commands.md:136-180 references/cli-commands.md:231-235 references/cli-commands.md:304-322 references/cli-commands.md:399-407

Privileged Azure CLI Examples Require Explicit Confirmation

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

High

references/console-app-example.md:183

System prompt extraction attempt

# Display instructions to user

Force-confirmed blocker/high static finding; AI dismissal overridden.

High

references/oauth-flows.md:247

System prompt extraction attempt

#### 2. Display Instructions to User

Force-confirmed blocker/high static finding; AI dismissal overridden.

Risk Factors

🌐 Network access (70)

📁 Filesystem access (8)

⚙️ External commands (24)

🔑 Env variables (1)

references/sdk/azure-identity-py.md:24

Audited by: codex

Audit version 2

Jun 30, 2026, 08:01 AM

Static analysis produced many command, network, filesystem, weak-crypto, and prompt-related alerts, but review found they are primarily Markdown examples for Microsoft Entra, OAuth, Azure CLI, and SDK usage. The skill is publishable with warning because its examples can create credentials, grant consent, query directory data, or delete app registrations if run in a real tenant.

Files scanned

2,657

Lines analyzed

Review items

False positives ignored

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/cli-commands.md:359-388 references/cli-commands.md:399-408 references/api-permissions.md:173-176

High-impact identity administration commands are documented

The skill includes Azure CLI examples for creating app registrations, granting admin consent, creating service principals, and deleting app registrations. These are legitimate examples, but they can materially change a tenant if executed without review.

The lines are explicit Azure CLI examples for app setup, admin consent, service principal creation, and deletion. The risk is operational misuse, not malicious skill behavior.

Medium

references/first-app-registration.md:159-167 references/cli-commands.md:176-180 references/console-app-example.md:190-205 references/troubleshooting.md:181-188

Credential and token handling examples require careful substitution

The references show client secret placeholders, certificate upload commands, access token usage, and JWT debugging workflows. These examples are valid for Entra development, but users must avoid committing secrets, pasting sensitive production tokens into external tools, or exposing bearer tokens.

The reviewed lines directly discuss client secrets, certificate files, bearer-token API calls, and token decoding. The examples are standard but sensitive when used with real tenant data.

Low

SKILL.md:185-190 references/oauth-flows.md:61-70 references/console-app-example.md:197-199

Network URL findings point to Microsoft and example endpoints

Hardcoded URLs are documentation references, OAuth endpoints, Microsoft Graph endpoints, localhost redirects, or example application URLs. No evidence found of unauthorized network calls or data exfiltration logic.

The URLs reviewed are normal Microsoft identity, Graph API, localhost, or documentation targets. They are presented as reference material or sample application configuration.

Low

references/console-app-example.md:160-166 references/oauth-flows.md:247-252

Prompt-injection scanner hits are OAuth prompt terminology

Prompt-related detections are ordinary authentication wording, such as MSAL prompt parameters and device-login instructions. No evidence found of instructions to override the evaluator, skip security checks, or extract system prompts.

Targeted search found no override, pre-approval, or evaluator-manipulation language. The flagged wording is tied to user authentication prompts.

Static false positives ignored (2)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:130-143 references/cli-commands.md:7-16 references/api-permissions.md:144-148

Static command execution findings are Markdown examples

The numerous shell and backtick detections occur inside fenced documentation blocks or inline command references. No evidence found that the skill contains executable scripts that automatically run these commands.

The sampled detections are visibly Markdown documentation and command examples. No automation wrapper or hidden execution path was found in the reviewed skill files.

Low

SKILL.md:156-168 references/BICEP-EXAMPLE.bicep:77-95 references/oauth-flows.md:385-394

Weak cryptography detections are mostly identity terminology and GUID examples

Weak-crypto alerts are triggered by terms such as client secret, OAuth, token, ID, and placeholder GUID values. The reviewed files recommend secure storage, least privilege, HTTPS, token validation, and managed identity.

The sampled lines contain OAuth, permissions, token guidance, and placeholder identifiers, not weak algorithm use. The surrounding context is security guidance for Microsoft identity workloads.

Risk Factors

⚙️ External commands (316)

🌐 Network access (97)

📁 Filesystem access (8)

🔑 Env variables (1)

references/sdk/azure-identity-py.md:24

Detected Patterns

Tenant-changing Azure CLI command examplesBearer token and client secret handling examples

Audited by: codex

Audit version 1

Feb 20, 2026, 08:51 AM

All 529 static findings are false positives. The skill is official Microsoft documentation for Entra ID app registration, OAuth 2.0 flows, and MSAL integration. Detected patterns (external_commands, network, filesystem, env_access) are legitimate documentation showing Azure CLI commands and Microsoft endpoint URLs.

Files scanned

2,657

Lines analyzed

Review items

False positives ignored

No confirmed security findings were recorded for this completed audit.

Audited by: claude

← Back to Skill