Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-oauth-token-theftnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-oauth-token-theft -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-oauth-token-theft -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-oauth-token-theftgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-oauth-token-theftgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-oauth-token-theft ~/.claude/skills/detecting-oauth-token-theft # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-oauth-token-theft ~/.agents/skills/detecting-oauth-token-theft # Codex, Cursor, Gemini CLI, Copilot, OpenCode