azure-redteam-inventory

Use this skill during an Azure red team engagement to perform preflight reconnaissance — validate the caller's Azure permissions and build the shared resource inventory that the rest of the red team depends on. Trigger when starting an Azure assessment, running reconnaissance, enumerating Azure resources in scope, or checking whether the assessor has sufficient RBAC. Typically dispatched first by the azure-redteam-orchestrator (Pentest Manager).

Aller à l'installation

Dépôt: Contoso-State/red-team-agent-orchestration
Dernière activité de la source: 17 juin 2026 à 15:15
Langue détectée de SKILL.md: anglais
Étoiles: 6
Forks: 1

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/Contoso-State/red-team-agent-orchestration --skill azure-redteam-inventory

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

azure-redteam-orchestrator

Use this skill when the user wants to run, coordinate, or manage an Azure cloud security penetration test or red team assessment against an Azure environment. This is the "Pentest Manager" that validates engagement scope, spins up the specialist red team, assigns reconnaissance and assessment tasks, and aggregates findings into a report. Engagements are single-subscription per run. Trigger on requests like "pentest my Azure environment", "run a red team assessment", "find security vulnerabilities in my Azure subscription", or "coordinate an Azure security assessment".

2026-08-03

azure-redteam-ai

Use this skill to assess Azure AI and machine-learning security during a red team engagement. Covers Azure AI Foundry (hubs, projects, connections), Azure OpenAI, Azure AI Services / Cognitive Services, and Azure Machine Learning workspaces. Finds public network access on AI endpoints, key-based auth instead of managed identity, disabled content/abuse filtering, exposed model deployments, over-privileged AI managed identities, and AI-to-data connections that expose grounding data. Trigger when assessing Azure OpenAI, AI Foundry, Cognitive Services, AI Search grounding, or Azure ML security.

2026-06-17

azure-redteam-aks-container

Use this skill to assess Azure container and Kubernetes security during a red team engagement. Owns AKS, Azure Container Registry (ACR), Container Apps, and Container Instances. Finds public API servers, local-admin kubeconfig, missing Entra/Azure RBAC for Kubernetes, no network policy, Pod Security Admission gaps, in-cluster cluster-admin RBAC sprawl, node managed-identity exposure via IMDS, registry admin-user and anonymous pull, missing content trust, and vulnerable container images. Read-only by default, with a hard-gated cluster-active lane (kube-bench/kubesec, offline trivy/grype image scanning, and benign read-only in-pod inventory) that scans inside a live cluster only under mode cluster-active-testing. Trigger when assessing AKS clusters, Kubernetes security, container images, ACR, or running-container vulnerabilities in Azure.

2026-06-17

Tout voir dans ce dépôt

Azure Red Team — Inventory & Scope (Preflight)

You are the preflight specialist. Before any domain skill touches a resource, you confirm authorization, validate effective RBAC, and produce an accurate inventory of in-scope Azure resources. Garbage inventory means false negatives across the whole assessment.

Full methodology: agents/inventory-scope/system-prompt.md. Read and follow it.

What You Do

Confirm identity — az account show; record identity type and object ID.

Validate permissions — check effective RBAC for required capabilities. Reader (or Owner/Contributor) is a hard requirement: if it is missing, STOP and tell the user to grant it before re-running. Record any other missing role (Security Reader, Log Analytics Reader, Directory Reader, Key Vault Reader) as a coverage limitation; do not fail the run for those. Always confirm the intended identity + permissions with the user before enumerating.

Enumerate resources — prefer Azure Resource Graph (azure-arm MCP tool or az graph query) for a single consistent snapshot. Apply scope and exclusions from engagement.yaml. Queries: tools/resource-graph/queries.md. Helper script: tools/powershell/Export-Inventory.ps1.

Write inventory — engagements/<session>/inventory/resources.jsonl per schemas/inventory.schema.json, plus engagements/<session>/inventory/subscriptions.json and engagements/<session>/inventory/coverage-limitations.json.

Tools

azure-subscription_list, azure-group_list, azure-group_resource_list, azure-arm (Resource Graph), azure-role, Azure CLI.

Safety

Read-only always. Honor exclusions strictly. Redact tags/names if data_handling flags require it.