Is entra-agent-id safe?
Grade B, 86/100. Minor issues.
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
Bentra-agent-id
.github/plugins/azure-skills/skills/entra-agent-id86/100 · Minor issues5 medium3 low
entra-agent-id
.github/plugins/azure-skills/skills/entra-agent-idProvision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
- Content hash
- sha256:0b1d85bef8e8fce448ad5764e5bceb0f0696e277dbad252696a89642c139fcd6
- Files
- 7
- Quality
- 100/100
Security findings
- mediumUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/SKILL.md:147
resp = requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.
- mediumUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/SKILL.md:165
resp = requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.
- mediumUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/SKILL.md:186
resp = requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.
- mediumUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/SKILL.md:231
requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.
- mediumUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/SKILL.md:249
requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host.
- lowUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/references/oauth2-token-flow.md:39
requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.
- lowUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/references/oauth2-token-flow.md:111
resp = requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.
- lowUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/entra-agent-id/references/obo-blueprint-setup.md:63
requests.post(The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.
Files in this skill
- SKILL.md15.7 KB
- references/known-limitations.md4.6 KB
- references/oauth2-token-flow.md4.4 KB
- references/obo-blueprint-setup.md4.1 KB
- references/runtime-token-exchange.md6.6 KB
- references/sdk-sidecar-deployment.md6.1 KB
- references/sdk-sidecar.md6.0 KB
Questions about entra-agent-id
- Is entra-agent-id safe to install?
- Our scanner gave entra-agent-id grade B (86/100): minor issues. It matched 8 rule(s); review them below before installing. Static analysis cannot prove safety, so pin the reviewed revision with a lockfile.
- How do I install entra-agent-id in Claude Code or Codex?
- Run skillhash add github:microsoft/azure-skills/.github/plugins/azure-skills/skills/entra-agent-id. It downloads the exact commit, checks the grade against your policy, writes skills.lock and installs it into .claude/skills and .agents/skills.
- What happens if entra-agent-id changes upstream?
- Its content hash changes. skillhash verify fails in CI until you review the new version and update the lock. With a watch, you also get an alert.
More from microsoft/azure-skills
- A
azure-advisor
1.6kmicrosoft/azure-skills
Use Azure Advisor recommendations. WHEN: "show Advisor recommendations", "service retirements", "update recommendation status". DO NOT USE FOR: fixes or remediation (use azure-advisor-actionability).
No security findings - A
aks-gpu-inference
1.6kmicrosoft/azure-skills
Diagnose Day-2 AKS GPU and KAITO incidents using profile-aware, read-only evidence. WHEN: 'Insufficient nvidia.com/gpu', GPU pod Pending, model-load OOM, DCGM/VRAM, KAITO Workspace not ready, or GPU autoscaling. DO NOT USE FOR: setup (airunway-aks-setup), non-GPU incidents (aks-troubleshooting), standalone VM quota (azure-quotas), or generic cost (cost-analysis or cost-optimization from the optional azure-cost plugin).
No security findings - A
prepare
1.6kmicrosoft/azure-skills
No description in SKILL.md.
No security findings - A
aks-known-issues
1.6kmicrosoft/azure-skills
Lookup documented AKS fixes only when the prompt includes an exact catalog signature and all of its qualifiers: VMCannotFitEphemeralOSDisk; NodePoolMcVersionIncompatible; 'NodeImageVersion is not accepted'; AKS SkuNotAvailable with size, location, and zone; ZonalAllocationFailed with insufficient zone capacity; OverconstrainedAllocationRequest with listed constraints; nested AKS vmssCSE/CSE VMExtensionError_OutboundConnFail, VMExtensionError_K8SAPIServerConnFail, or VMExtensionError_K8SAPIServerDNSLookupFail; or AllocationFailed with the full cataloged internal-error or insufficient-regional-capacity message. Never use for quota errors, code-only or bare wrappers, generic symptoms, incomplete signatures, or failures outside AKS; use aks-troubleshooting or azure-diagnostics.
No security findings - A
aks-network-capture
1.6kmicrosoft/azure-skills
Collects bounded packet captures from AKS nodes and Azure network configuration for wire-level evidence. WHEN: "capture packets on an AKS node", "take a pcap", "run tcpdump on AKS", "prove where packets drop". Use for explicit packet-capture intent after read-only diagnostics, not general AKS connectivity or ingress troubleshooting.
No security findings - A
aks-troubleshooting
1.6kmicrosoft/azure-skills
Debug live Azure Kubernetes Service (AKS) incidents with a read-only, evidence-first investigation. WHEN: pod crashes or Pending, CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, DNS or ingress failure, connectivity timeout, network policy, SNAT exhaustion, node-pool scaling blocked by QuotaExceeded or InsufficientVCPUQuota, upgrade stuck, spot or zone disruption, a bare VMExtensionProvisioningError or AllocationFailed wrapper, an uncataloged capacity symptom, or 'investigate my AKS cluster'. DO NOT USE FOR: packet capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); cluster creation or provisioning (use azure-kubernetes); cost (use cost-analysis from the optional azure-cost plugin); pod rightsizing (use azure-kubernetes); a fully qualified documented AKS signature with every required nested qualifier (use aks-known-issues); standalone failures on non-AKS Azure resources (use azure-diagnostics). Unqualified errors and open-ended incidents stay here only for AKS.
No security findings - A
scaffold
1.6kmicrosoft/azure-skills
No description in SKILL.md.
No security findings - A
azure-advisor-actionability
1.6kmicrosoft/azure-skills
Remediate Azure Advisor recommendations. WHEN: "fix Advisor recommendation".
No security findings