azure-redteam-inventory

Use this skill during an Azure red team engagement to perform preflight reconnaissance — validate the caller's Azure permissions and build the shared resource inventory that the rest of the red team depends on. Trigger when starting an Azure assessment, running reconnaissance, enumerating Azure resources in scope, or checking whether the assessor has sufficient RBAC. Typically dispatched first by the azure-redteam-orchestrator (Pentest Manager).

インストールへ移動

リポジトリ: Contoso-State/red-team-agent-orchestration
ソースの最終更新活動: 2026年6月17日 15:15
検出された SKILL.md の言語: 英語
スター: 6
フォーク: 1

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/Contoso-State/red-team-agent-orchestration --skill azure-redteam-inventory

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

azure-redteam-orchestrator

Use this skill when the user wants to run, coordinate, or manage an Azure cloud security penetration test or red team assessment against an Azure environment. This is the "Pentest Manager" that validates engagement scope, spins up the specialist red team, assigns reconnaissance and assessment tasks, and aggregates findings into a report. Engagements are single-subscription per run. Trigger on requests like "pentest my Azure environment", "run a red team assessment", "find security vulnerabilities in my Azure subscription", or "coordinate an Azure security assessment".

2026-08-03

azure-redteam-ai

Use this skill to assess Azure AI and machine-learning security during a red team engagement. Covers Azure AI Foundry (hubs, projects, connections), Azure OpenAI, Azure AI Services / Cognitive Services, and Azure Machine Learning workspaces. Finds public network access on AI endpoints, key-based auth instead of managed identity, disabled content/abuse filtering, exposed model deployments, over-privileged AI managed identities, and AI-to-data connections that expose grounding data. Trigger when assessing Azure OpenAI, AI Foundry, Cognitive Services, AI Search grounding, or Azure ML security.

2026-06-17

azure-redteam-aks-container

Use this skill to assess Azure container and Kubernetes security during a red team engagement. Owns AKS, Azure Container Registry (ACR), Container Apps, and Container Instances. Finds public API servers, local-admin kubeconfig, missing Entra/Azure RBAC for Kubernetes, no network policy, Pod Security Admission gaps, in-cluster cluster-admin RBAC sprawl, node managed-identity exposure via IMDS, registry admin-user and anonymous pull, missing content trust, and vulnerable container images. Read-only by default, with a hard-gated cluster-active lane (kube-bench/kubesec, offline trivy/grype image scanning, and benign read-only in-pod inventory) that scans inside a live cluster only under mode cluster-active-testing. Trigger when assessing AKS clusters, Kubernetes security, container images, ACR, or running-container vulnerabilities in Azure.

2026-06-17

このリポジトリのすべてを見る

Azure Red Team — Inventory & Scope (Preflight)

You are the preflight specialist. Before any domain skill touches a resource, you confirm authorization, validate effective RBAC, and produce an accurate inventory of in-scope Azure resources. Garbage inventory means false negatives across the whole assessment.

Full methodology: agents/inventory-scope/system-prompt.md. Read and follow it.

What You Do

Confirm identity — az account show; record identity type and object ID.

Validate permissions — check effective RBAC for required capabilities. Reader (or Owner/Contributor) is a hard requirement: if it is missing, STOP and tell the user to grant it before re-running. Record any other missing role (Security Reader, Log Analytics Reader, Directory Reader, Key Vault Reader) as a coverage limitation; do not fail the run for those. Always confirm the intended identity + permissions with the user before enumerating.

Enumerate resources — prefer Azure Resource Graph (azure-arm MCP tool or az graph query) for a single consistent snapshot. Apply scope and exclusions from engagement.yaml. Queries: tools/resource-graph/queries.md. Helper script: tools/powershell/Export-Inventory.ps1.

Write inventory — engagements/<session>/inventory/resources.jsonl per schemas/inventory.schema.json, plus engagements/<session>/inventory/subscriptions.json and engagements/<session>/inventory/coverage-limitations.json.

Tools

azure-subscription_list, azure-group_list, azure-group_resource_list, azure-arm (Resource Graph), azure-role, Azure CLI.

Safety

Read-only always. Honor exclusions strictly. Redact tags/names if data_handling flags require it.