The Agent Skills Directory

[SAFE]: The skill provides legitimate cybersecurity defensive patterns for identity security monitoring and incident response.
[SAFE]: The administrative commands and queries provided in the documentation (KQL and PowerShell) are standard tools for managing Entra ID environments and do not contain malicious bypasses or obfuscation.
[SAFE]: The Python utility scripts/agent.py performs offline analysis of sign-in logs using mathematical and temporal logic without any dangerous side effects, such as unauthorized network access or command execution.
[SAFE]: The skill processes untrusted log data, but the analysis script lacks exploitable capabilities (e.g., shell access, file-write, or network operations) that would expose it to indirect prompt injection risks.
Ingestion points: scripts/agent.py accepts external JSON log files via the --log-file parameter.
Boundary markers: Absent; the data is processed as structured JSON.
Capability inventory: Analysis logic is limited to mathematical calculations, string comparison, and console reporting via print statements.
Sanitization: Uses standard Python json.load for parsing; no execution of data content occurs.

detecting-oauth-token-theft