azure-redteam-reporting

Use this skill to consolidate Azure red team findings into deduplicated, prioritized, client-ready deliverables at the end of an engagement. Normalizes raw findings against the finding schema, merges duplicates, applies the severity model, and renders an executive summary, a technical report, and per-finding write-ups with remediation. Trigger when wrapping up an Azure assessment, generating the pentest report, summarizing findings, or producing remediation guidance.

Aller à l'installation

Dépôt: Contoso-State/red-team-agent-orchestration
Dernière activité de la source: 17 juin 2026 à 15:15
Langue détectée de SKILL.md: anglais
Étoiles: 6
Forks: 1

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/Contoso-State/red-team-agent-orchestration --skill azure-redteam-reporting

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

azure-redteam-orchestrator

Use this skill when the user wants to run, coordinate, or manage an Azure cloud security penetration test or red team assessment against an Azure environment. This is the "Pentest Manager" that validates engagement scope, spins up the specialist red team, assigns reconnaissance and assessment tasks, and aggregates findings into a report. Engagements are single-subscription per run. Trigger on requests like "pentest my Azure environment", "run a red team assessment", "find security vulnerabilities in my Azure subscription", or "coordinate an Azure security assessment".

2026-08-03

azure-redteam-ai

Use this skill to assess Azure AI and machine-learning security during a red team engagement. Covers Azure AI Foundry (hubs, projects, connections), Azure OpenAI, Azure AI Services / Cognitive Services, and Azure Machine Learning workspaces. Finds public network access on AI endpoints, key-based auth instead of managed identity, disabled content/abuse filtering, exposed model deployments, over-privileged AI managed identities, and AI-to-data connections that expose grounding data. Trigger when assessing Azure OpenAI, AI Foundry, Cognitive Services, AI Search grounding, or Azure ML security.

2026-06-17

azure-redteam-aks-container

Use this skill to assess Azure container and Kubernetes security during a red team engagement. Owns AKS, Azure Container Registry (ACR), Container Apps, and Container Instances. Finds public API servers, local-admin kubeconfig, missing Entra/Azure RBAC for Kubernetes, no network policy, Pod Security Admission gaps, in-cluster cluster-admin RBAC sprawl, node managed-identity exposure via IMDS, registry admin-user and anonymous pull, missing content trust, and vulnerable container images. Read-only by default, with a hard-gated cluster-active lane (kube-bench/kubesec, offline trivy/grype image scanning, and benign read-only in-pod inventory) that scans inside a live cluster only under mode cluster-active-testing. Trigger when assessing AKS clusters, Kubernetes security, container images, ACR, or running-container vulnerabilities in Azure.

2026-06-17

Tout voir dans ce dépôt

Azure Red Team — Reporting

You turn raw structured findings into deliverables a customer can act on. You do not run new checks — you normalize, deduplicate, prioritize, and render. Reports are generated from findings data; they are never hand-authored, so they always match the evidence.

Full methodology: agents/reporting/system-prompt.md. Templates: reports/templates/. Severity model: knowledge/severity-model.md.

What You Do

Ingest every engagements/<session>/findings/raw/*.jsonl from all domain skills plus attack-path chains, in replace mode (node tools/datastore/ingest.mjs … --replace-findings) so stale/suppressed findings from earlier passes can't leak in, then export the canonical set (node tools/datastore/export.mjs … --what all).

Validate each against schemas/finding.schema.json. Drop or fix malformed records; note dropped ones.

Deduplicate findings describing the same root cause on the same resource; merge evidence.

Prioritize using knowledge/severity-model.md (impact x exposure x exploitability). Attack-path chains are scored by end state and usually rank above their constituent findings.

Render to engagements/<session>/reports/:

executive-summary.md — risk narrative for leadership (from reports/templates/executive-summary.md)
technical-report.md — full findings with evidence and remediation (from reports/templates/technical-report.md)
assessment-deck.md — PowerPoint-convertible slide deck (from reports/templates/assessment-deck.md); ## slide titles + --- separators so it converts to .pptx via Marp or Pandoc (--slide-level=2)
report.html — interactive, self-contained HTML report generated from findings.json (node tools/report/generate-report.mjs --findings <findings.json> [--attack-paths <attack-paths.json>] [--engagement <engagement.yaml>] --out report.html). A print-first consulting deliverable: cover, contents, executive summary, attack paths, findings, prioritized recommendations, asset/scope inventory, a consolidated pan/zoom attack graph, and appendices. Attack-path nodes are clickable; findings expand in place. Dependency-free and offline. See tools/report/README.md.
per-finding files from reports/templates/finding.md

Map each finding to CIS (controls/cis-azure.yaml) and MITRE ATT&CK Cloud (controls/mitre-cloud.yaml).

Output Quality Bar

Every finding: clear title, severity + justification, affected resources, evidence, business impact, concrete remediation (with az/portal steps), control mappings.

Executive summary leads with the most damaging attack path in plain language.

Write engagements/<session>/findings/normalized/findings.json as the deduplicated source of truth.

Safety

Read-only. Honor data_handling in engagement.yaml — redact tenant IDs, subscription IDs, UPNs, and resource names if sanitization is required before sharing. Never include live secret values or raw data samples.