CtrlK
BlogDocsLog inGet started
Tessl Logo

entra-device-code-phishing

Entra ID OAuth device-code phishing for token theft, illicit consent grant via malicious app registration with delegated Graph scopes, refresh-token replay, and primary-refresh-token (PRT) abuse concepts.

61

Quality

73%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/entra-device-code-phishing/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

82%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands throughout, well-structured by phase, and mostly token-efficient. Its main weakness is workflow clarity around explicit validation/feedback loops, which are implicit rather than spelled out for the destructive/replay operations.

Suggestions

Add explicit validation checkpoints before destructive/replay steps (e.g., 'Verify ACCESS token scope with `jq -r .scope` before mail exfil; if missing Mail.Read, re-swap via FOCI').

Make error-recovery feedback explicit beyond the device-code poll loop (e.g., what to do on `invalid_grant` or expired code).

Consider moving the Tools and Detection signatures lists into a reference file to tighten the core body, given the skill's operational focus.

DimensionReasoningScore

Conciseness

The body is dense and mostly efficient — copy-paste curl/bash with terse inline comments and minimal preamble — with only minor over-explanation (e.g., the FOCI paragraph restates the swap). It does not dwell on concepts Claude already knows.

4 / 5

Actionability

Provides fully executable, copy-paste-ready curl and PowerShell commands across all phases (device-code request, token polling, FOCI swap, consent URL, token exchange, replay, roadtx), with concrete client IDs and Graph endpoints covering the common cases.

5 / 5

Workflow Clarity

Phases are clearly sequenced (device-code → consent → replay → PRT) with a 'Decision gate' section acting as checkpoints, but validation/verification feedback loops (e.g., confirm a token's scope before replay, retry on error beyond the poll loop) are only implicit rather than explicit.

4 / 5

Progressive Disclosure

Well-organized into clear sections (Phases 1–4, Chains, Tools, Detection signatures, Decision gate) with the body self-contained and no bundle files present; minor gap is that some reference-style material (tool list, detection signatures) is inline rather than split out, but for a sub-50-line-ish skill this is acceptable.

4 / 5

Total

17

/

20

Passed

Description

63%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, distinctive, and rich in natural trigger terms, but it omits any explicit 'Use when...' trigger guidance, so completeness is capped at 3 per the rubric. Adding a one-sentence trigger clause would likely raise completeness.

Suggestions

Add an explicit 'Use when...' clause stating when Claude should invoke this skill (e.g., 'Use when targeting Entra ID / Azure AD token theft via device-code or illicit-consent phishing').

Optionally include common user phrasings such as 'Azure AD phishing' or 'OAuth app consent abuse' to broaden natural trigger coverage.

Confirm third-person voice is preserved (it is) and avoid padding the capability list further to keep it concise.

DimensionReasoningScore

Specificity

Enumerates concrete actions — 'token theft', 'illicit consent grant via malicious app registration with delegated Graph scopes', 'refresh-token replay', and 'PRT abuse concepts' — giving several specific capabilities with only minor coverage gaps (e.g., token swap/exfil not in description).

4 / 5

Completeness

The 'what' is clearly and comprehensively stated, but there is no explicit 'Use when...' / 'when should Claude use it' clause, which the guidelines cap at 3.

3 / 5

Trigger Term Quality

Strong natural keywords a user would say ('device code phishing', 'oauth', 'illicit consent', 'malicious app registration', 'refresh token replay', 'PRT') with good synonym coverage, though some common phrasings like 'Entra ID token theft' phrasing and file/tool extensions are absent.

4 / 5

Distinctiveness Conflict Risk

The description carves a clear niche (Entra ID device-code + illicit-consent phishing) with distinctive trigger terms and minimal overlap risk against unrelated skills.

5 / 5

Total

16

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.