CtrlK
BlogDocsLog inGet started
Tessl Logo

entra-enum

Entra ID / M365 reconnaissance — unauthenticated tenant discovery via OpenID config, GetUserRealm, autodiscover; user enumeration via login response codes and OneDrive; federation/MFA/CA posture; authenticated enumeration with ROADtools (roadrecon), AADInternals, MSGraph.

65

Quality

79%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/cloud/entra-enum/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

83%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exceptionally lean, executable recon runbook with strong actionability and conciseness. Workflow clarity is capped at 3 by the missing validation checkpoints on batch enumeration loops, and progressive disclosure is good but slightly limited by the monolithic single-file layout.

Suggestions

Add explicit validation/verification checkpoints to the enumeration loops (e.g. confirm a 403 vs 404 interpretation, throttle-check, and a stop-condition before scaling a spray) to lift the batch-operation workflow-clarity cap.

Split the Tools and Detection-signatures sections into references/ files (e.g. TOOLS.md, DETECTION.md) and link to them from the body so SKILL.md stays a concise overview.

DimensionReasoningScore

Conciseness

Lean and command-driven throughout with no padding explaining what Entra ID or OAuth is; nearly every line is an executable curl/jq/PowerShell command with terse, load-bearing inline comments (e.g. 'AADSTS50053 = locked'), assuming Claude's competence.

5 / 5

Actionability

Fully executable, copy-paste-ready commands cover the common cases — OpenID config fetch, getuserrealm, autodiscover SOAP, the OneDrive enum loop, roadrecon auth/gather/dump, AADInternals cmdlets, and direct Graph curl queries.

5 / 5

Workflow Clarity

The Phase 0→3 sequence and the Decision-gate branching are clear, but this is a batch/enumeration skill and the enumeration loops lack explicit validate-then-proceed checkpoints, so the rubric's batch-operation cap holds workflow clarity at 3.

3 / 5

Progressive Disclosure

Well-organized into clear sections (Phase 0–3, Chains, Tools, Detection, Decision gate) with signaled cross-links to sibling skills, but the file is monolithic (~145 lines) with no bundle files, and sections like the tool catalog and detection signatures are inlined where separate reference files could help.

4 / 5

Total

17

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is highly specific and distinctive, naming concrete endpoints and tools across unauth and authed enumeration. Its main weakness is the absence of an explicit 'Use when...' trigger clause, which caps completeness at 3.

Suggestions

Add an explicit 'Use when...' clause naming natural trigger phrases (e.g. 'Use when enumerating Entra ID / Azure AD tenants, validating M365 users, or assessing federation and MFA/CA posture before auth').

Include common synonyms like 'Azure AD' and 'Office 365' alongside 'Entra ID' / 'M365' so the description matches the phrasing users actually say.

DimensionReasoningScore

Specificity

Lists multiple concrete actions with named endpoints/tools — 'tenant discovery via OpenID config, GetUserRealm, autodiscover', 'user enumeration via login response codes and OneDrive', 'authenticated enumeration with ROADtools (roadrecon), AADInternals, MSGraph' — giving comprehensive coverage of the skill's capabilities.

5 / 5

Completeness

The 'what' is clearly and comprehensively answered, but there is no 'Use when...' clause or equivalent explicit trigger guidance — the 'when' is only weakly implied by the topic terms, capping completeness at 3 per the rubric guideline.

3 / 5

Trigger Term Quality

Strong natural-term coverage ('Entra ID', 'M365', 'reconnaissance', 'user enumeration', 'OneDrive', 'ROADtools', 'AADInternals') that a user would plausibly say, but a few common synonyms ('Azure AD', 'Office 365') are absent, keeping it just below comprehensive.

4 / 5

Distinctiveness Conflict Risk

A clear niche (Entra ID/M365 reconnaissance) with distinct, tool-specific triggers and minimal overlap risk with unrelated skills.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.