Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill intune-app-protectiongit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/intune-app-protection)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/intune-app-protection"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/intune-app-protection/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/intune-app-protection"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/intune-app-protection.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00174 | $0.01568 |
| Opus 5 | $0.00087 | $0.00784 |
| Sonnet 5 | $0.00035 | $0.00314 |
| Haiku 4.5 | $0.00017 | $0.00157 |
Grade A, and why
intune-app-protection scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsoft Intune - App Protection Policies (MAM)
Intune app protection policies (APP / MAM) protect organisational data inside apps at the application layer, with or without device enrollment. They make BYOD safe by isolating corporate data inside managed apps and enabling selective wipe of org data without touching personal content.
When to use
Protecting Microsoft 365 and Intune-SDK-enabled app data on mobile devices, especially unmanaged / personal devices (MAM without enrollment, MAM-WE). Use this skill when full device enrollment is undesirable or impractical.
Do not use this skill for full device management (intune-device-mgmt) or disk
encryption (bitlocker-design).
Pick the protection model
| Scenario | Model | Notes |
|---|---|---|
| BYOD - no enrollment | MAM without enrollment (MAM-WE) | Default for personal devices |
| Corporate-owned, managed | APP on managed devices | Layered on top of MDM |
| Mix of corporate + BYOD | Both | Same APP, different deployment scope |
| Frontline / shared device | App protection + Shared Device mode | Per-user data isolation |
| Strict regulated data | APP + Conditional Access app filter | CA-enforced gating |
Rule of thumb: if you want the user to keep their personal data and the device, but the company to keep its data, MAM-WE. APP without CA enforcement is optional; APP with CA "Require app protection policy" is enforced.
Approach
-
Choose the model and target audience — MAM-WE for BYOD, APP on managed devices for corporate. Both target users and groups, not devices. Per platform: iOS/iPadOS and Android. Verify: APP assignment shows the right user groups; status report shows policy delivered to the target population.
-
Data protection settings — Restrict cut/copy/paste to managed apps; prevent "Save As" to personal locations; restrict backup to iCloud/Google Drive; require encryption of org data at rest in the app. Verify: testing on a personal device shows paste from Outlook → personal Notes is blocked.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 113 lines · 174 tokens per session scan A d16815d4e5b2
intune-app-protection is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (173 stars, last pushed 2mo ago), licensed MIT. It adds 174 tokens to every session and 1,568 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
uno-platform
Build cross-platform .NET applications with Uno Platform targeting WebAssembly, iOS, Android, macOS, Linux, and Windows from a single XAML/C# codebase. USE FOR: building cross-platform apps from a single C# and XAML codebase; targeting WebAssembly, iOS, Android, macOS, Linux, and Windows simultaneously; migrating WPF…
swift-development
You MUST activate this skill when working on Swift projects.
power-automate
Use when operating Microsoft Power Automate cloud flows from code — create, enable, update, list or delete via the Dataverse Web API (workflow table, category 5) with Entra ID OAuth2, plus run-history debugging. NOT designing the flow definition (that is automation-flows), NOT picking a platform by billing model (that…
react-native-expert
Senior React Native and Expo engineer for building production-ready cross-platform mobile apps. Use when building React Native components, implementing navigation with Expo Router, optimizing list and scroll performance, working with animations via Reanimated, handling platform-specific code (iOS/Android), integrating…
kotlin-coroutines-expert
Expert patterns for Kotlin Coroutines and Flow, covering structured concurrency, error handling, and testing in this Android app.
mobile-perf-doctor
VERA ships a mobile and performance doctor: a small set of read-only tools that audit the project for things that hurt — or outright break — a mobile build. Use it proactively whenever the user is about to package for mobile, complains about device crashes, or worries about GPU/shader cost.