Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vinayaklatthe/microsoft-security-skills --skill intune-device-mgmtgit clone --depth 1 https://github.com/vinayaklatthe/microsoft-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/intune-device-mgmt)<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/intune-device-mgmt"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/intune-device-mgmt/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vinayaklatthe/microsoft-security-skills/intune-device-mgmt"><img src="https://agentmods.dev/badge/skills/vinayaklatthe/microsoft-security-skills/intune-device-mgmt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00181 | $0.01622 |
| Opus 5 | $0.00090 | $0.00811 |
| Sonnet 5 | $0.00036 | $0.00324 |
| Haiku 4.5 | $0.00018 | $0.00162 |
Grade A, and why
intune-device-mgmt scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsoft Intune - Device Management
Microsoft Intune is the cloud-based endpoint management service for enrolling, configuring, securing, and monitoring devices across Windows, macOS, iOS/iPadOS, Android, and Linux. It is the source of device compliance signal that Conditional Access uses for access decisions.
When to use
Managing corporate and BYOD device fleets and producing the compliance signal Conditional Access depends on. Use this skill to plan enrollment, compliance, baselines, and rollout rings.
Do not use this skill for app-only protection on personal devices (intune-app-protection),
EDR (defender-for-endpoint), or disk encryption (bitlocker-design).
Pick the enrollment method by platform and ownership
| Platform | Corporate-owned | Personal (BYOD) |
|---|---|---|
| Windows | Autopilot + Entra join (pre-provisioned or user-driven) | Entra registration + MAM or co-managed |
| macOS | Apple Business Manager (ABM) + ADE enrollment | User-enrolled (limited management) |
| iOS/iPadOS | ABM + ADE supervised | User enrollment (account-driven preferred) |
| Android | Android Enterprise fully managed (corporate) | Android Enterprise work profile |
Rule of thumb: if the device is corporate-owned, full MDM via Autopilot / ABM / Android Enterprise fully managed. If personal, prefer work profile (Android) or user enrollment (iOS) for clean separation of corporate and personal data. Never enroll personal devices into full MDM - users push back and you carry liability for personal data.
Approach
-
Enrollment — Configure platform-specific enrollment (Autopilot deployment profiles, ABM token + ADE profiles, Android Enterprise binding). Block personal-platform enrollment for corporate users if that's the policy (enrollment restrictions). Verify: an Autopilot device hits the Out-of-Box Experience and lands joined + Intune- enrolled in one pass without IT touch.
-
Configuration profiles — Use the settings catalog (not legacy templates). Deploy Wi-Fi / VPN / certificate profiles, OS hardening, browser policies. One profile per purpose; don't bundle unrelated settings.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 113 lines · 181 tokens per session scan A b20176692f37
intune-device-mgmt is a skill published in the GitHub repository vinayaklatthe/microsoft-security-skills (173 stars, last pushed 2mo ago), licensed MIT. It adds 181 tokens to every session and 1,622 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
uno-platform
Build cross-platform .NET applications with Uno Platform targeting WebAssembly, iOS, Android, macOS, Linux, and Windows from a single XAML/C# codebase. USE FOR: building cross-platform apps from a single C# and XAML codebase; targeting WebAssembly, iOS, Android, macOS, Linux, and Windows simultaneously; migrating WPF…
swift-development
You MUST activate this skill when working on Swift projects.
power-automate
Use when operating Microsoft Power Automate cloud flows from code — create, enable, update, list or delete via the Dataverse Web API (workflow table, category 5) with Entra ID OAuth2, plus run-history debugging. NOT designing the flow definition (that is automation-flows), NOT picking a platform by billing model (that…
react-native-expert
Senior React Native and Expo engineer for building production-ready cross-platform mobile apps. Use when building React Native components, implementing navigation with Expo Router, optimizing list and scroll performance, working with animations via Reanimated, handling platform-specific code (iOS/Android), integrating…
kotlin-coroutines-expert
Expert patterns for Kotlin Coroutines and Flow, covering structured concurrency, error handling, and testing in this Android app.
mobile-perf-doctor
VERA ships a mobile and performance doctor: a small set of read-only tools that audit the project for things that hurt — or outright break — a mobile build. Use it proactively whenever the user is about to package for mobile, complains about device crashes, or worries about GPU/shader cost.