m365-entra-attack

Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable red-team operational reference with strong validation discipline, but it is a padded monolith: repeated warnings, inlined time-sensitive dates, and reference tables that belong in separate files keep it from being lean or progressively disclosed.

Suggestions

Consolidate the concurrency/anti-spray warning into one canonical section — it is currently repeated in the Pace block, the CRITICAL TRAP, and the Anti-patterns list.

Move time-sensitive re-verification dates (2026-05-17) and deprecation dates (Oct 2022) into a dedicated 'Shelf life / deprecated' section so the inlined operational guidance stays evergreen.

Split the AADSTS code table, CA-bypass options table, password-pattern list, and report template into references/*.md files linked from SKILL.md to enable one-level-deep progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Mostly high-signal operational reference, but noticeably padded in places: the concurrency/anti-spray warning is restated in the Pace section, the CRITICAL TRAP, and Anti-patterns, and time-sensitive dates ('May 2026', '2026-05-17', 'Oct 2022') are inlined rather than isolated, which the rubric penalizes.	3 / 5
Actionability	Fully executable, copy-paste-ready code (the ROPC attempt() validator, the Playwright SAML flow) plus specific HTTP requests, concrete client_ids, and a complete AADSTS code-action table; the few placeholders ('selectors vary per SP', 'replace marker per target app') are explicitly justified rather than left vague.	5 / 5
Workflow Clarity	Validation and feedback loops are strong and explicit (atomic per-user cap check, kill-switch on >5 AADSTS50053, JSON-parse-not-substring trap, 5-step active-attacker detection checklist), satisfying the destructive/batch cap, but the end-to-end flow is implied by section order rather than given as one explicit numbered procedure tying the phases together.	4 / 5
Progressive Disclosure	No references/scripts/assets bundle files exist and the skill is a single ~378-line monolith with clear headers but inlined reference material (AADSTS table, CA-bypass table, password patterns, report template) that could be split into one-level-deep references/*.md files.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states both capability and trigger conditions for an M365/Entra red-team attack skill. The only gap is missing common product synonyms (Azure AD / O365 / Office 365) that some users will say.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — 'AADSTS code reference', 'user enumeration vectors (with hardening status)', 'Smart Lockout math', 'Conditional Access bypass options', 'ROPC + SAML SSO browser flow', 'Burp/Playwright templates' — giving comprehensive coverage rather than just a domain label.	5 / 5
Completeness	Explicitly answers both what (the attack-chain capabilities enumerated) and when ('Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario').	5 / 5
Trigger Term Quality	Strong natural phrases a red-teamer would say ('credential attack', 'password spray', 'user enumeration', 'CA-bypass exploration', 'active-attacker-detection'), but missing common synonyms like 'Azure AD', 'O365', or 'Office 365' that users also say.	4 / 5
Distinctiveness Conflict Risk	Carves a clear niche (M365/Entra red-team credential attacks) with distinct triggers and minimal overlap risk against adjacent phishing or on-prem-AD skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/m365-entra-attack/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.