entra-agent-id

The skill provides instructions for creating and managing high-privilege Entra identities and granting broad permissions (e.g., User.Read.All), which could be abused to escalate privileges or establish persistence if the agent is compromised. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

Granting per-Agent-Identity application (appRoleAssignments) or delegated (oauth2PermissionGrants) permissions

Runaway agent loop — excessive retry counts, deep recursion, or self-recursive call patterns

retry 403

Direct shell/command execution sink in skill code

subprocess.run(
    ["az", "ad", "signed-in-user", "show", "--query", "id", "-o", "tsv"],
    capture_output=True, text=True, check=True,
)

Outbound network request primitive in skill code — can transmit data externally

requests.post(
    f"{GRAPH}/applications/microsoft.graph.agentIdentityBlueprint",
    headers=headers, json=blueprint_body,
)

Outbound network request primitive in skill code — can transmit data externally

requests.post(
    f"{GRAPH}/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal",
    headers=headers, json=sp_body,
)

Outbound network request primitive in skill code — can transmit data externally

requests.post(
    f"{GRAPH}/servicePrincipals/microsoft.graph.agentIdentity",
    headers=headers, json=agent_body,
)

Outbound network request primitive in skill code — can transmit data externally (seen 2 times in this file at lines 1, 8)

requests.get(
    f"{GRAPH}/servicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'",
    headers=headers,
)

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

SKILL.md links to "references/oauth2-token-flow.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/oauth2-token-flow.md](references/oauth2-token-flow.md)

SKILL.md links to "references/obo-blueprint-setup.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/obo-blueprint-setup.md](references/obo-blueprint-setup.md)

SKILL.md links to "references/runtime-token-exchange.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/runtime-token-exchange.md](references/runtime-token-exchange.md)

SKILL.md links to "references/sdk-sidecar-deployment.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/sdk-sidecar-deployment.md](references/sdk-sidecar-deployment.md)