azure-redteam-reporting

Use this skill to consolidate Azure red team findings into deduplicated, prioritized, client-ready deliverables at the end of an engagement. Normalizes raw findings against the finding schema, merges duplicates, applies the severity model, and renders an executive summary, a technical report, and per-finding write-ups with remediation. Trigger when wrapping up an Azure assessment, generating the pentest report, summarizing findings, or producing remediation guidance.

Ir para a instalação

Repositório: Contoso-State/red-team-agent-orchestration
Última atividade na origem: 17 de junho de 2026 às 15:15
Idioma detectado do SKILL.md: inglês
Estrelas: 6
Forks: 1

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/Contoso-State/red-team-agent-orchestration --skill azure-redteam-reporting

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

azure-redteam-orchestrator

Use this skill when the user wants to run, coordinate, or manage an Azure cloud security penetration test or red team assessment against an Azure environment. This is the "Pentest Manager" that validates engagement scope, spins up the specialist red team, assigns reconnaissance and assessment tasks, and aggregates findings into a report. Engagements are single-subscription per run. Trigger on requests like "pentest my Azure environment", "run a red team assessment", "find security vulnerabilities in my Azure subscription", or "coordinate an Azure security assessment".

2026-08-03

azure-redteam-ai

Use this skill to assess Azure AI and machine-learning security during a red team engagement. Covers Azure AI Foundry (hubs, projects, connections), Azure OpenAI, Azure AI Services / Cognitive Services, and Azure Machine Learning workspaces. Finds public network access on AI endpoints, key-based auth instead of managed identity, disabled content/abuse filtering, exposed model deployments, over-privileged AI managed identities, and AI-to-data connections that expose grounding data. Trigger when assessing Azure OpenAI, AI Foundry, Cognitive Services, AI Search grounding, or Azure ML security.

2026-06-17

azure-redteam-aks-container

Use this skill to assess Azure container and Kubernetes security during a red team engagement. Owns AKS, Azure Container Registry (ACR), Container Apps, and Container Instances. Finds public API servers, local-admin kubeconfig, missing Entra/Azure RBAC for Kubernetes, no network policy, Pod Security Admission gaps, in-cluster cluster-admin RBAC sprawl, node managed-identity exposure via IMDS, registry admin-user and anonymous pull, missing content trust, and vulnerable container images. Read-only by default, with a hard-gated cluster-active lane (kube-bench/kubesec, offline trivy/grype image scanning, and benign read-only in-pod inventory) that scans inside a live cluster only under mode cluster-active-testing. Trigger when assessing AKS clusters, Kubernetes security, container images, ACR, or running-container vulnerabilities in Azure.

2026-06-17

Ver todas deste repositório

Azure Red Team — Reporting

You turn raw structured findings into deliverables a customer can act on. You do not run new checks — you normalize, deduplicate, prioritize, and render. Reports are generated from findings data; they are never hand-authored, so they always match the evidence.

Full methodology: agents/reporting/system-prompt.md. Templates: reports/templates/. Severity model: knowledge/severity-model.md.

What You Do

Ingest every engagements/<session>/findings/raw/*.jsonl from all domain skills plus attack-path chains, in replace mode (node tools/datastore/ingest.mjs … --replace-findings) so stale/suppressed findings from earlier passes can't leak in, then export the canonical set (node tools/datastore/export.mjs … --what all).

Validate each against schemas/finding.schema.json. Drop or fix malformed records; note dropped ones.

Deduplicate findings describing the same root cause on the same resource; merge evidence.

Prioritize using knowledge/severity-model.md (impact x exposure x exploitability). Attack-path chains are scored by end state and usually rank above their constituent findings.

Render to engagements/<session>/reports/:

executive-summary.md — risk narrative for leadership (from reports/templates/executive-summary.md)
technical-report.md — full findings with evidence and remediation (from reports/templates/technical-report.md)
assessment-deck.md — PowerPoint-convertible slide deck (from reports/templates/assessment-deck.md); ## slide titles + --- separators so it converts to .pptx via Marp or Pandoc (--slide-level=2)
report.html — interactive, self-contained HTML report generated from findings.json (node tools/report/generate-report.mjs --findings <findings.json> [--attack-paths <attack-paths.json>] [--engagement <engagement.yaml>] --out report.html). A print-first consulting deliverable: cover, contents, executive summary, attack paths, findings, prioritized recommendations, asset/scope inventory, a consolidated pan/zoom attack graph, and appendices. Attack-path nodes are clickable; findings expand in place. Dependency-free and offline. See tools/report/README.md.
per-finding files from reports/templates/finding.md

Map each finding to CIS (controls/cis-azure.yaml) and MITRE ATT&CK Cloud (controls/mitre-cloud.yaml).

Output Quality Bar

Every finding: clear title, severity + justification, affected resources, evidence, business impact, concrete remediation (with az/portal steps), control mappings.

Executive summary leads with the most damaging attack path in plain language.

Write engagements/<session>/findings/normalized/findings.json as the deduplicated source of truth.

Safety

Read-only. Honor data_handling in engagement.yaml — redact tenant IDs, subscription IDs, UPNs, and resource names if sanitization is required before sharing. Never include live secret values or raw data samples.