New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Detecting Suspicious OAuth Application Consent

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

Apache-2.0Auto-check passedBackend & APIs

Install Detecting Suspicious OAuth Application Consent

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-oauth-application-consent -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-suspicious-oauth-application-consent --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/detecting-suspicious-oauth-application-consent .claude/skills/detecting-suspicious-oauth-application-consent && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
detecting-suspicious-oauth-application-consent
GitHub stars
34k
Token cost
~605 tokens
SKILL.md length
235 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

  • Works in 7 steps: Authenticate to Microsoft Graph using… → Enumerate all OAuth2 permission grants… → List service principals and their… → …
  • Tasks that involve OAuth and OpenID Connect
  • SKILL.md covers Overview, When to Use, Prerequisites and Steps, plus 1 more section
  • Runs Python scripts from its folder

What it does

Detecting Suspicious OAuth Application Consent is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

Its SKILL.md is about 610 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Backend & APIs, covering OAuth and OpenID Connect. It works with Microsoft Entra ID and Microsoft 365. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve OAuth and OpenID Connect

Example prompts

  • “/detecting-suspicious-oauth-application-consent”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Authenticate to Microsoft Graph using MSAL client credentials flow
  2. Enumerate all OAuth2 permission grants via /oauth2PermissionGrants
  3. List service principals and their assigned application permissions
  4. Query directory audit logs for Consent to application events
  5. Flag applications with high-risk scopes (Mail.Read, Files.ReadWrite.All, etc.)
  6. Check publisher verification status for each application
  7. Generate risk report with remediation recommendations

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Detecting Suspicious OAuth Application Consent loads about 605 tokens when it runs, and up to ~1.3k if it reads all its reference files. Until then it costs about 58 tokens; SKILL.md has 235 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~58
When it runs · the whole SKILL.md, loaded when a task matches
~605
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 235 words, ~605 tokens.

Download SKILL.mdSave it as .claude/skills/detecting-suspicious-oauth-application-consent/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
detecting-suspicious-oauth-application-consent
description
Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.
domain
cybersecurity
subdomain
cloud-security
tags
OAuth, Azure-AD, Entra-ID, Microsoft-Graph, illicit-consent, cloud-security, application-permissions
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
PR.IR-01, ID.AM-08, GV.SC-06, DE.CM-01
mitre_attack
T1528, T1550.001, T1098.001, T1566.002

Overview

Illicit consent grant attacks trick users into granting excessive permissions to malicious OAuth applications in Azure AD / Microsoft Entra ID. This skill uses the Microsoft Graph API to enumerate OAuth2 permission grants, analyze application permissions for overly broad scopes, review directory audit logs for consent events, and flag high-risk applications based on publisher verification status and permission scope.

When to Use

  • When investigating security incidents that require detecting suspicious oauth application consent
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Azure AD / Entra ID tenant with Global Reader or Security Reader role
  • Microsoft Graph API access with Application.Read.All, AuditLog.Read.All, Directory.Read.All
  • Python 3.9+ with msal, requests
  • App registration with client secret or certificate for authentication

Steps

  1. Authenticate to Microsoft Graph using MSAL client credentials flow
  2. Enumerate all OAuth2 permission grants via /oauth2PermissionGrants
  3. List service principals and their assigned application permissions
  4. Query directory audit logs for Consent to application events
  5. Flag applications with high-risk scopes (Mail.Read, Files.ReadWrite.All, etc.)
  6. Check publisher verification status for each application
  7. Generate risk report with remediation recommendations

Expected Output

  • JSON report listing all OAuth apps with granted permissions, risk scores, unverified publishers, and suspicious consent patterns
  • Audit trail of consent grant events with user and IP details

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/detecting-suspicious-oauth-application-consent of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Detecting Suspicious OAuth Application Consent next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Detecting Suspicious OAuth Application Consent compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Detecting Suspicious OAuth Application Consent this skillmukul975/Anthropic-Cybersecurity-Skills34k—~605Automated safety check: PassApache-2.0
Entra Agent Idmicrosoft/GitHub-Copilot-for-Azure2552 repos~4kAutomated safety check: PassMIT
Investigating M365 Entratrilwu/secskills157—~4.1kAutomated safety check: PassMIT
Entra Agent Idmicrosoft/skills3.1k—~2.3kAutomated safety check: PassMIT
Msal Auth Code FlowAzureAD/microsoft-authentication-library-for-dotnet1.5k—~917Automated safety check: PassMIT
Azure APIM Policy Authoringthomast1906/github-copilot-agent-skills202—~1.5kAutomated safety check: PassMIT

Similar skills

  • Entra Agent Id

    microsoft/GitHub-Copilot-for-Azure

    Official

    Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant)…

    255 GitHub starsUsed in 2 repos~4k tokens
    Backend & APIsAuto-check passed

  • Investigating M365 Entra

    trilwu/secskills

    Investigate security incidents in Microsoft 365 and Entra ID (Azure AD) -- search the Unified Audit Log, correlate sign-in and audit events, trace illicit OAuth consent grants, analyze mailbox rule…

    157 GitHub stars~4.1k tokensUpdated 1 mo ago
    Backend & APIsAuto-check passed

  • Entra Agent Id

    microsoft/skills

    Official

    Microsoft Entra Agent ID (preview) for creating OAuth2-capable AI agent identities via Microsoft Graph beta API.

    3.1k GitHub stars~2.3k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Msal Auth Code Flow

    AzureAD/microsoft-authentication-library-for-dotnet

    Authorization Code Flow for web applications using MSAL.NET confidential client to sign in users and access APIs on their behalf

    1.5k GitHub stars~917 tokensUpdated 3 days ago
    Backend & APIsAuto-check passed

  • Azure APIM Policy Authoring

    thomast1906/github-copilot-agent-skills

    Generates Azure API Management policy XML for authentication, rate limiting, CORS, error handling and transformations, consulting Azure best-practice and documentation tools first.

    202 GitHub stars~1.5k tokensUpdated 3 days ago
    Backend & APIsAuto-check passed

  • Maui Authentication

    davidortinau/maui-skills

    Add authentication to .NET MAUI apps. An agent skill from davidortinau/maui-skills.

    175 GitHub stars~1.5k tokensUpdated 3 mo ago
    Backend & APIsAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Detecting Suspicious OAuth Application Consent

What does Detecting Suspicious OAuth Application Consent do?

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks. Detecting Suspicious OAuth Application Consent is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit logs, and permission analysis to identify illicit consent grant attacks.

When should I use Detecting Suspicious OAuth Application Consent?

Detecting Suspicious OAuth Application Consent fits situations like: tasks that involve OAuth and OpenID Connect.

How do I install Detecting Suspicious OAuth Application Consent in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-oauth-application-consent -a claude-code`. Or copy the skill folder (skills/detecting-suspicious-oauth-application-consent in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/detecting-suspicious-oauth-application-consent in your project. Claude Code loads it when a task matches its description.

How do I install Detecting Suspicious OAuth Application Consent in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-oauth-application-consent -a codex`. Or copy the skill folder (skills/detecting-suspicious-oauth-application-consent in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/detecting-suspicious-oauth-application-consent in your project. Codex loads it when a task matches its description.

Can I use Detecting Suspicious OAuth Application Consent in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-oauth-application-consent -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/detecting-suspicious-oauth-application-consent, .gemini/skills/detecting-suspicious-oauth-application-consent, .github/skills/detecting-suspicious-oauth-application-consent and .opencode/skills/detecting-suspicious-oauth-application-consent in your project.

What does Detecting Suspicious OAuth Application Consent need to run?

Going by SKILL.md and its folder, Detecting Suspicious OAuth Application Consent needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Detecting Suspicious OAuth Application Consent access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Detecting Suspicious OAuth Application Consent safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Detecting Suspicious OAuth Application Consent use?

Detecting Suspicious OAuth Application Consent is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Detecting Suspicious OAuth Application Consent use?

About 605 tokens (SKILL.md is roughly 2.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 682 tokens, read only when the agent opens those files.

What are the alternatives to Detecting Suspicious OAuth Application Consent?

Skills that share tags, products or a category with Detecting Suspicious OAuth Application Consent: Entra Agent Id (microsoft/GitHub-Copilot-for-Azure, 255 stars), Investigating M365 Entra (trilwu/secskills, 157 stars), Entra Agent Id (microsoft/skills, 3.1k stars) and Msal Auth Code Flow (AzureAD/microsoft-authentication-library-for-dotnet, 1.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Detecting Suspicious OAuth Application Consent?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.