Runs GraphRunner, a PowerShell post-exploitation toolset built on the Microsoft Graph API, to perform tenant recon, establish persistence (OAuth app injection, inbox rules), escalate privilege via group manipulation, and pillage mailboxes, SharePoint, and Teams data from a foothold Graph token.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill post-exploiting-microsoft-graph-with-graphrunnernpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill post-exploiting-microsoft-graph-with-graphrunner -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill post-exploiting-microsoft-graph-with-graphrunner -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/post-exploiting-microsoft-graph-with-graphrunnergh skill install mukul975/Anthropic-Cybersecurity-Skills post-exploiting-microsoft-graph-with-graphrunnergit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/post-exploiting-microsoft-graph-with-graphrunner ~/.claude/skills/post-exploiting-microsoft-graph-with-graphrunner # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/post-exploiting-microsoft-graph-with-graphrunner ~/.agents/skills/post-exploiting-microsoft-graph-with-graphrunner # Codex, Cursor, Gemini CLI, Copilot, OpenCode