microsoft/azure-skills entra-agent-id
Checked the catalogued skill at entra-agent-id.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
22 suppressed by AI triage
The requests POST is a legitimate API call for creating an agent blueprint in Microsoft Graph.
This POST request creates a BlueprintPrincipal, a standard provisioning step in Microsoft Graph usage.
The POST call creates an agent instance, a normal operation for managing Azure AD entities.
The GET request retrieves service principals for permission assignment, a routine Graph API interaction.
This POST assigns app roles to a service principal, a standard Microsoft Graph operation.
The POST to oauth2PermissionGrants sets delegated permissions, a normal Graph API usage.
Illustrates an outbound HTTP call in documentation, not executed code.
Shows an outbound POST request example; not runtime execution.
No actual base64 string present; scanner false positive.
Path shown is a literal API endpoint, not a traversal.
No base64 content; scanner misidentified documentation text.
Outbound call shown only as a code example; not executed.
Documentation code example for legitimate Microsoft Graph API usage
Documentation code example for legitimate permission grant usage
Demonstrates a standard, documented use of urllib to obtain an OAuth token, not malicious.
Illustrates a legitimate token request via urllib, part of normal operation.
Shows typical use of urllib to fetch a token; not a threat.
Example code for acquiring a Graph token; benign.
Part of documented token exchange flow, not malicious.
Shows standard on-behalf-of token request, benign.
Example of delegated token retrieval; benign.
The base64 string is an example JWT in documentation, not malicious code.