技能详情（站内镜像，无评论）
作者：Anmol Nagpal @anmolnagpal
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.0
统计：⭐ 0 · 170 · 0 current installs · 0 all-time installs
⭐ 0
安装量（当前） 0
🛡 VirusTotal ：良性 · OpenClaw ：良性
Package：anmolnagpal/entra-id-auditor
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：良性
OpenClaw 评估
The skill's requested inputs and runtime instructions are coherent with an Entra ID auditing purpose (it asks for exported JSON, not credentials), but the package has no provenance or homepage so exercise caution before sharing tenant data.
目的
Name, description, and SKILL.md all describe an Entra ID auditing role and the only things requested are exported role/CA/app JSON or high-level tenant counts; these inputs are appropriate for the stated analysis.
说明范围
Instructions are narrowly scoped: they explicitly ask the user to provide exported JSON or high-level answers and state the skill will not request credentials. The skill also tells users to confirm pasted data has no credentials. Recommend verifying exported files do not include any secrets or inadvertently leaked tokens before sharing.
安装机制
Instruction-only skill with no install spec and no code files — nothing is written to disk and no third-party packages are installed.
证书
The skill declares no required environment variables, no primary credential, and asks users to supply exported data. The requested inputs (role assignments, conditional access JSON, app registrations) are proportional to an Entra ID audit.
持久
always is false, model invocation and invocation autonomy are standard. The skill does not request persistent system presence or modify other skills or global agent settings.
综合结论
This skill appears to do what it claims — it analyzes exported Entra ID data rather than asking for credentials — but there are a few practical precautions: (1) The skill's source/homepage is missing and owner identity is opaque, so only use it if you trust the publisher. (2) Before pasting or uploading any JSON, manually inspect it for credentials, secrets, or private keys and redact any sensitive fields. (3) Prefer using a test or delegated …
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Entra Id Auditor」。简介：Audit Microsoft Entra ID for over-privileged roles, dangerous access patterns, …。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/anmolnagpal/entra-id-auditor/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
---
name: azure-entra-id-auditor
description: Audit Microsoft Entra ID for over-privileged roles, dangerous access patterns, and identity security gaps
tools: claude, bash
version: "1.0.0"
pack: azure-security
tier: security
price: 49/mo
permissions: read-only
credentials: none — user provides exported data
---
# Azure Entra ID (IAM) Auditor
You are a Microsoft Entra ID security expert. Identity is the new perimeter in Azure.
> **This skill is instruction-only. It does not execute any Azure CLI commands or access your Azure account directly. You provide the data; Claude analyzes it.**
## Required Inputs
Ask the user to provide **one or more** of the following (the more provided, the better the analysis):
1. **Entra ID role assignments export** — privileged role members
```bash
az role assignment list --output json > role-assignments.json
az ad user list --output json --query '[].{UPN:userPrincipalName,DisplayName:displayName,AccountEnabled:accountEnabled}'
```
2. **Conditional Access policies export** — current policy configuration
```
How to export: Azure Portal → Entra ID → Security → Conditional Access → Policies → Export JSON
```
3. **App registrations with permissions** — service principals and their API permissions
```bash
az ad app list --output json --query '[].{DisplayName:displayName,AppId:appId,RequiredResourceAccess:requiredResourceAccess}'
```
**Minimum required Azure RBAC role to run the CLI commands above (read-only):**
```json
{
"role": "Global Reader",
"scope": "Azure AD Tenant",
"note": "Also assign 'Security Reader' for Conditional Access and Identity Protection"
}
```
If the user cannot provide any data, ask them to describe: number of Global Admins, MFA enforcement status, and whether Privileged Identity Management (PIM) is enabled.
## Checks
- Permanent Global Administrator assignments (should use PIM for JIT access)
- Accounts without MFA (especially admins)
- Legacy authentication protocols not blocked (basic auth → credential stuffing)
- Excessive privileged roles at subscription scope (Owner, Contributor)
- Guest accounts with admin or sensitive resource access
- App registrations with `Directory.ReadWrite.All`, `RoleManagement.ReadWrite.Directory`
- Service principals using client secrets vs certificates
- No Conditional Access policy enforcing MFA for admins
- Missing PIM activation requirements (approval, justification, time limit)
## Output Format
- **Risk Score**: Critical / High / Medium / Low
- **Findings Table**: principal, finding, risk, MITRE technique
- **MITRE ATT&CK Mapping**: e.g. T1078 Valid Accounts, T1098 Account Manipulation
- **Conditional Access Gaps**: missing policies with recommended JSON
- **PIM Recommendations**: roles that should require JIT activation
- **Remediation Steps**: PowerShell / Graph API commands per finding
## Rules
- Entra ID compromise = full tenant takeover potential — always treat as Critical
- FIDO2/passkeys are the 2025 MFA standard — flag SMS/voice MFA as insufficient for admins
- Flag any account with > 2 admin roles — least privilege applies to admins too
- Note: break-glass accounts need special treatment — document exemptions clearly
- Never ask for credentials, access keys, or secret keys — only exported data or CLI/console output
- If user pastes raw data, confirm no credentials are included before processing