CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

attacking-entra-id-with-roadtools

Enumerate Microsoft Entra ID (Azure AD) tenants with ROADrecon and acquire, exchange, and abuse tokens (including primary refresh tokens) with roadtx. Use for authorized red-team enumeration of a tenant's directory objects or for token-based identity attacks against Entra ID you are explicitly authorized to test.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-sequenced, highly actionable recon workflow with executable commands and a validation checklist. Its main weakness is progressive disclosure: existing reference and script bundle files are not linked or signaled from the body, leaving their relationship to the SKILL.md unclear.

Suggestions

Add a one-line pointer in the body to references/api-reference.md and scripts/agent.py (e.g., 'Full command/flag reference: see references/api-reference.md') so the bundle layer is clearly signaled.

Insert an inline validation checkpoint after Step 1 (confirm .roadtools_auth was created) and after Step 2 (confirm roadrecon.db populated) before proceeding to later steps.

Trim the overlap between the inline command flags and the references/api-reference.md tables so the body stays an overview and the reference holds the exhaustive detail.

DimensionReasoningScore

Conciseness

Mostly efficient command-driven content, but the Overview and MITRE table restate information already in the workflow steps, and the FOCI acronym is expanded more than once.

4 / 5

Actionability

Every workflow step is a copy-paste-ready, executable command with real flags and client/resource aliases, covering the common auth, gather, token, and PRT cases.

5 / 5

Workflow Clarity

Eight clearly sequenced steps plus a terminal Validation Criteria checklist, but inline validation checkpoints between steps are implicit (e.g., confirming .roadtools_auth exists before gather) rather than enforced.

4 / 5

Progressive Disclosure

The body has good section structure but never links to the provided bundle files (references/api-reference.md, references/standards.md, scripts/agent.py); the api-reference content overlaps the body rather than being signaled as the detail layer.

3 / 5

Total

16

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A precise, action-oriented description that concretely states capabilities and provides an explicit use-when trigger scoped to authorized red-team work. Minor room to add a few more natural user synonyms, but it is otherwise strong.

DimensionReasoningScore

Specificity

Names multiple concrete actions — 'Enumerate... tenants', 'acquire, exchange, and abuse tokens (including primary refresh tokens)' — giving comprehensive coverage of the toolkit's capabilities.

5 / 5

Completeness

Explicitly answers both 'what' (enumerate, acquire/exchange/abuse tokens) and 'when' via a concrete 'Use for...' clause naming authorized red-team enumeration and token-based identity attacks.

5 / 5

Trigger Term Quality

Strong natural terms (Microsoft Entra ID, Azure AD, tokens, primary refresh tokens, red-team enumeration) with synonym coverage, but a few common user phrasings like 'Azure AD recon' or 'cloud identity attack' are only partially represented.

4 / 5

Distinctiveness Conflict Risk

Clear niche scoped to ROADrecon/roadtx against Entra ID with distinct triggers and an authorization qualifier, minimizing overlap with other skills.

5 / 5

Total

19

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

mukul975/Anthropic-Cybersecurity-Skills

Path

skills/attacking-entra-id-with-roadtools/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.