azure-redteam-reporting

Use this skill to consolidate Azure red team findings into deduplicated, prioritized, client-ready deliverables at the end of an engagement. Normalizes raw findings against the finding schema, merges duplicates, applies the severity model, and renders an executive summary, a technical report, and per-finding write-ups with remediation. Trigger when wrapping up an Azure assessment, generating the pentest report, summarizing findings, or producing remediation guidance.

Ir a la instalación

Repositorio: Contoso-State/red-team-agent-orchestration
Última actividad en el origen: 17 de junio de 2026 a las 15:15
Idioma detectado de SKILL.md: inglés
Estrellas: 6
Forks: 1

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/Contoso-State/red-team-agent-orchestration --skill azure-redteam-reporting

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

azure-redteam-orchestrator

Use this skill when the user wants to run, coordinate, or manage an Azure cloud security penetration test or red team assessment against an Azure environment. This is the "Pentest Manager" that validates engagement scope, spins up the specialist red team, assigns reconnaissance and assessment tasks, and aggregates findings into a report. Engagements are single-subscription per run. Trigger on requests like "pentest my Azure environment", "run a red team assessment", "find security vulnerabilities in my Azure subscription", or "coordinate an Azure security assessment".

2026-08-03

azure-redteam-ai

Use this skill to assess Azure AI and machine-learning security during a red team engagement. Covers Azure AI Foundry (hubs, projects, connections), Azure OpenAI, Azure AI Services / Cognitive Services, and Azure Machine Learning workspaces. Finds public network access on AI endpoints, key-based auth instead of managed identity, disabled content/abuse filtering, exposed model deployments, over-privileged AI managed identities, and AI-to-data connections that expose grounding data. Trigger when assessing Azure OpenAI, AI Foundry, Cognitive Services, AI Search grounding, or Azure ML security.

2026-06-17

azure-redteam-aks-container

Use this skill to assess Azure container and Kubernetes security during a red team engagement. Owns AKS, Azure Container Registry (ACR), Container Apps, and Container Instances. Finds public API servers, local-admin kubeconfig, missing Entra/Azure RBAC for Kubernetes, no network policy, Pod Security Admission gaps, in-cluster cluster-admin RBAC sprawl, node managed-identity exposure via IMDS, registry admin-user and anonymous pull, missing content trust, and vulnerable container images. Read-only by default, with a hard-gated cluster-active lane (kube-bench/kubesec, offline trivy/grype image scanning, and benign read-only in-pod inventory) that scans inside a live cluster only under mode cluster-active-testing. Trigger when assessing AKS clusters, Kubernetes security, container images, ACR, or running-container vulnerabilities in Azure.

2026-06-17

Ver todos los de este repositorio

Azure Red Team — Reporting

You turn raw structured findings into deliverables a customer can act on. You do not run new checks — you normalize, deduplicate, prioritize, and render. Reports are generated from findings data; they are never hand-authored, so they always match the evidence.

Full methodology: agents/reporting/system-prompt.md. Templates: reports/templates/. Severity model: knowledge/severity-model.md.

What You Do

Ingest every engagements/<session>/findings/raw/*.jsonl from all domain skills plus attack-path chains, in replace mode (node tools/datastore/ingest.mjs … --replace-findings) so stale/suppressed findings from earlier passes can't leak in, then export the canonical set (node tools/datastore/export.mjs … --what all).

Validate each against schemas/finding.schema.json. Drop or fix malformed records; note dropped ones.

Deduplicate findings describing the same root cause on the same resource; merge evidence.

Prioritize using knowledge/severity-model.md (impact x exposure x exploitability). Attack-path chains are scored by end state and usually rank above their constituent findings.

Render to engagements/<session>/reports/:

executive-summary.md — risk narrative for leadership (from reports/templates/executive-summary.md)
technical-report.md — full findings with evidence and remediation (from reports/templates/technical-report.md)
assessment-deck.md — PowerPoint-convertible slide deck (from reports/templates/assessment-deck.md); ## slide titles + --- separators so it converts to .pptx via Marp or Pandoc (--slide-level=2)
report.html — interactive, self-contained HTML report generated from findings.json (node tools/report/generate-report.mjs --findings <findings.json> [--attack-paths <attack-paths.json>] [--engagement <engagement.yaml>] --out report.html). A print-first consulting deliverable: cover, contents, executive summary, attack paths, findings, prioritized recommendations, asset/scope inventory, a consolidated pan/zoom attack graph, and appendices. Attack-path nodes are clickable; findings expand in place. Dependency-free and offline. See tools/report/README.md.
per-finding files from reports/templates/finding.md

Map each finding to CIS (controls/cis-azure.yaml) and MITRE ATT&CK Cloud (controls/mitre-cloud.yaml).

Output Quality Bar

Every finding: clear title, severity + justification, affected resources, evidence, business impact, concrete remediation (with az/portal steps), control mappings.

Executive summary leads with the most damaging attack path in plain language.

Write engagements/<session>/findings/normalized/findings.json as the deduplicated source of truth.

Safety

Read-only. Honor data_handling in engagement.yaml — redact tenant IDs, subscription IDs, UPNs, and resource names if sanitization is required before sharing. Never include live secret values or raw data samples.