azure-cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate Azure CLI administration skill, but it needs Review because it includes unsafe install guidance and high-impact Azure commands with limited safeguards.

Install Azure CLI using verified Microsoft package instructions instead of copying the curl-to-bash line. Before using this skill, confirm the active Azure subscription and resource group, treat tokens, kubeconfig files, connection strings, and service-principal secrets as sensitive, and do not run delete, --yes, --no-wait, or bulk xargs examples unless you have explicitly reviewed the targets. The included cleanup script should not be trusted to remove resources because its delete mode does not actually delete anything.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:30

Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Location: README.md:30 and SKILL.md:56
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

README.md:30:

bash

curl -sL https://aka.ms/InstallAzureCliLinux | bash

SKILL.md:56:

bash

curl -sL https://aka.ms/InstallAzureCliLinux | bash

Technical Analysis

These installation instructions follow a mutable URL redirect and pass the returned content directly to Bash. The payload is not pinned to a version or cryptographic digest, and the user has no opportunity to authenticate or inspect the final script before execution.

The URL uses Microsoft's aka.ms redirect service, which reduces but does not eliminate the security risk. The effective payload can change after this Skill has been reviewed. Compromise of the redirect, destination host, TLS trust chain, upstream publishing process, or installer could therefore turn these instructions into an arbitrary-code execution channel.

Installing Azure CLI is necessary for the declared Azure-management functionality. However, executing a remote response directly through a shell is not the minimum-risk or minimum-privilege installation method. Repository-based package installation with signature verification can provide the same functionality with stronger supply-chain controls.

Attack Path

1. A user or agent follows the Linux installation instructions.
2. curl follows the mutable aka.ms redirect and downloads the current remote response.
3. The response is streamed directly into Bash without validation or inspection.
4. If the upstream content or delivery path has been compromised, attacker-controlled shell commands execute locally.
5. The payload obtains the privileges of the invoking user and may receive elevated privileges if the installer invokes sudo or the user runs the command as root.

Impact Assessment

Successful exploitation permits arbi ...[truncated 390 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct curl | bash instruction from both README.md and SKILL.md.
• Prefer Microsoft's documented package-repository installation process, including repository-signing-key and package-signature verification.
• Pin a tested Azure CLI version where operationally practical.
• If a remote installer must be used:
  1. Download it to a local file.
  2. Verify its final origin and expected cryptographic digest or signature.
  3. Review the downloaded content.
  4. Execute it only after verification.
• Do not run the installation as root unless a specific package-management step requires elevation.
• Document the exact commands requiring elevation rather than granting an entire remote script elevated execution.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96

Finding

Authentication and Administrative Secrets Are Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:96,256-261; README.md:254-259; references/REFERENCE.md:30,162,191,467,494-495,515-516
Vulnerability Type: Insecure handling of plaintext credentials
Risk Level: Medium

Vulnerable Code

SKILL.md:96:

bash

az login --service-principal -u APP_ID -p PASSWORD -t TENANT_ID

SKILL.md:256-261:

bash

az login --service-principal \
  --username $AZURE_CLIENT_ID \
  --password $AZURE_CLIENT_SECRET \
  --tenant $AZURE_TENANT_ID

README.md:254-259:

bash

az login --service-principal \
  --username $AZURE_CLIENT_ID \
  --password $AZURE_CLIENT_SECRET \
  --tenant $AZURE_TENANT_ID

references/REFERENCE.md:30:

bash

az login --service-principal -u APP_ID -p PASSWORD -t TENANT_ID

references/REFERENCE.md:162:

bash

az vm create -g RG_NAME -n VM_NAME --image Win2019Datacenter --admin-username azureuser --admin-password PASSWORD

references/REFERENCE.md:191:

bash

az vm user update -g RG_NAME -n VM_NAME -u USERNAME --password PASSWORD

references/REFERENCE.md:467:

bash

az sql server create -g RG_NAME -n SERVER_NAME -u ADMIN_USER -p PASSWORD

references/REFERENCE.md:494-495:

bash

az mysql server create -g RG_NAME -n SERVER_NAME -u ADMIN_USER -p PASSWORD \
  --sku-name B_Gen5_1 --storage-size 51200

references/REFERENCE.md:515-516:

bash

az postgres server create -g RG_NAME -n SERVER_NAME -u ADMIN_USER -p PASSWORD \
  --sku-name B_Gen5_1 --storage-size 51200

Technical Analysis

The examples encourage users to supply service-principal secrets and administrator passwords as process arguments. Although several values are placeholders or environment-variable references, users are expected to replace or expand them with real credentials.

Once expanded, secrets may be exposed through shell history, process inspection, CI/CD command tracing ...[truncated 1731 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer managed identity or workload identity federation for automated Azure authentication.
• Use interactive authentication for human-operated development sessions where appropriate.
• Use secure standard-input or secret-file mechanisms supported by the relevant command rather than placing credentials in arguments.
• Retrieve secrets at runtime from a managed secret store such as Azure Key Vault, without echoing them.
• Disable shell tracing around authentication and secret-handling commands.
• Configure CI/CD systems to mask secrets and avoid logging expanded command lines.
• Add explicit warnings that literal credentials must not be entered directly into commands or stored in scripts.
• Replace password-based VM access examples with SSH-key-based authentication where possible.
• Prefer identity-based database authentication over static administrator passwords.
• Scope service principals to the narrowest required resources and roles, and rotate any credential suspected of appearing in logs or process captures.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (24)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Piping curl output directly to bash executes remote content without prior verification, making users trust whatever the URL serves at runtime. If the shortlink target, transport path, or upstream install script is compromised, this can lead to immediate arbitrary code execution on the local machine.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

Linux:

bash

curl -sL https://aka.ms/InstallAzureCliLinux | bash

Windows:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash construct is dangerous because it turns fetched network data directly into executable shell input with no validation step. In a skill README, this pattern normalizes unsafe installation behavior and can result in full local compromise if the remote content changes or is tampered with.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

Linux:

bash

curl -sL https://aka.ms/InstallAzureCliLinux | bash

Windows:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 181)May include surrounding context.

Run startup script

az vm run-command invoke -g myRG -n myVM
--command-id RunShellScript
--scripts "sudo apt-get update && sudo apt-get install -y nginx"

echo "VM deployed: $VM_ID"

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description is significantly broader than the code’s real function. The script is not a comprehensive Azure management CLI; it specifically identifies potential cleanup targets using Azure CLI queries. Additionally, while the script presents a delete mode and warns about deletion, the provided code never invokes any az ... delete commands, so its actual behavior is read-only reporting. This is a material mismatch in primary purpose/scope and in the represented cleanup capability.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description is materially broader than the supplied code. The script only accepts a resource group, template file, optional parameters file, and deployment name; validates the template with az deployment group validate; and creates a resource-group deployment with az deployment group create, optionally using --no-wait. It does not provide comprehensive Azure Cloud Platform management. While the code does perform Azure CLI-based management, its actual purpose is specifically ARM/Bicep-style resource group deployment automation, not general Azure administration. Therefore the description does not accurately represent the code's true scope and primary behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description implies a broad, comprehensive Azure CLI management skill covering the Azure platform generally. The supplied code instead implements a single-purpose storage analysis/reporting script. It lists storage accounts, shows account properties, attempts to list containers and blob counts, and outputs cost-estimation reminders. There is no evidence of comprehensive platform management or broader Azure resource handling. This is a material description-to-behavior mismatch due to overstating the scope and primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description is much broader than the actual code behavior. This script does not provide comprehensive Azure platform management; it specifically retrieves Azure VM details using az vm list-ip-addresses, optionally scoped by resource group or subscription, and formats a status summary with jq. Its primary purpose is narrow, read-only VM status reporting rather than general Azure management. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Fetching a remote script and executing it directly with bash prevents users from inspecting what will run and creates a supply-chain risk if the URL, redirect, or serving infrastructure is compromised. This is particularly dangerous in a shell-focused skill because users are likely to copy the installation command verbatim.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Linux (Ubuntu/Debian):

bash

curl -sL https://aka.ms/InstallAzureCliLinux | bash

Windows:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Piping curl output straight into bash is a classic command-chaining anti-pattern that removes the opportunity for review and magnifies the impact of upstream compromise or network manipulation. In this context, it trains users into an unsafe execution habit that can lead to arbitrary code execution on their systems.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Linux (Ubuntu/Debian):

bash

curl -sL https://aka.ms/InstallAzureCliLinux | bash

Windows:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The batch operation pipes all VM IDs in a resource group directly into deletion, creating a high risk of mass accidental destruction if the resource group is mistyped or broadly scoped. In an automation-oriented skill, such one-liners are especially dangerous because they are easy to reuse at scale.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The command 'az account get-access-token' retrieves bearer tokens that can directly authorize Azure API actions within their scope. In a general-purpose skill, presenting this without secret-handling guidance materially increases the chance of credential leakage and subsequent account or resource compromise.

Content

Scanner excerpt · references/REFERENCE.md (reported line 43)May include surrounding context.

az account list # List all accessible accounts az account list-locations # List available Azure regions az account set --subscription ID # Set default subscription az account get-access-token # Get access token az account get-access-token --resource https://management.azure.com

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The AKS credential retrieval commands obtain kubeconfig, including an admin variant that can grant broad cluster access. Without warnings about sensitivity and least privilege, these examples can enable unauthorized cluster access if credentials are mishandled, persisted insecurely, or used by an agent beyond user intent.

Content

Scanner excerpt · references/REFERENCE.md (reported line 244)May include surrounding context.

md

az aks list -g RG_NAME                               # List in resource group
az aks show -g RG_NAME -n CLUSTER_NAME               # Get cluster details
az aks delete -g RG_NAME -n CLUSTER_NAME             # Delete cluster
az aks get-credentials -g RG_NAME -n CLUSTER_NAME    # Get kubeconfig
az aks get-credentials -g RG_NAME -n CLUSTER_NAME --admin  # Get admin credentials
az aks nodepool add -g RG_NAME --cluster-name CLUSTER -n nodepool2 --node-count 3
az aks nodepool list -g RG_NAME --cluster-name CLUSTER  # List node pools

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 181)May include surrounding context.

Run startup script

az vm run-command invoke -g myRG -n myVM
--command-id RunShellScript
--scripts "sudo apt-get update && sudo apt-get install -y nginx"

echo "VM deployed: $VM_ID"

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation includes destructive Azure delete commands without explicit warnings about irreversible resource removal, service disruption, and possible data loss. In an agent skill context, users may copy commands directly, making accidental destructive execution more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The VM deletion example is operationally valid and can terminate compute resources and associated workflows if copied without care. Because the skill is instructional and concise, the absence of a caution increases the risk of accidental destructive use by inexperienced operators.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

az storage account create -g RG -n ACCOUNT --sku Standard_LRS az storage account list az storage container create --account-name ACCOUNT -n CONTAINER az storage blob upload --account-name ACCOUNT -c CONTAINER -n BLOB -f LOCAL_FILE az storage blob download --account-name ACCOUNT -c CONTAINER -n BLOB -f LOCAL_FILE

text

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/REFERENCE.md (reported line 411)May include surrounding context.

az storage account create -g RG -n ACCOUNT --sku Standard_LRS az storage account list az storage container create --account-name ACCOUNT -n CONTAINER az storage blob upload --account-name ACCOUNT -c CONTAINER -n BLOB -f LOCAL_FILE az storage blob download --account-name ACCOUNT -c CONTAINER -n BLOB -f LOCAL_FILE

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Deleting an AKS cluster can cause immediate application outage, workload loss, and cascading impact to dependent services if used improperly. Presenting the command without a clear destruction warning is risky in a skill intended for broad operational use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document exposes secret-retrieval commands like 'az account get-access-token' without any warning that the resulting tokens are sensitive credentials. In an agent or copy-paste context, this can lead to credential disclosure in logs, chat transcripts, shell history, or subsequent unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The reference includes explicitly destructive commands such as resource-group deletion, including a variant that suppresses confirmation and returns immediately. In a skill intended to guide command execution, omitting any warning about irreversible deletion increases the risk of accidental or overly broad destructive actions by users or downstream agents.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The example 'az group delete -g RG_NAME --yes --no-wait' demonstrates non-interactive destructive execution that bypasses confirmation. In an agent skill, this makes unintended autonomous deletion more likely because the command is optimized for immediate execution without a user checkpoint.

Content

Scanner excerpt · references/REFERENCE.md (reported line 108)May include surrounding context.

md

az group list --output table                         # List with table output
az group show -g RG_NAME                             # Get resource group details
az group delete -g RG_NAME                           # Delete resource group
az group delete -g RG_NAME --yes --no-wait          # Delete without confirmation
az group update -g RG_NAME --tags env=prod team=backend  # Add tags
az group export -g RG_NAME                           # Export as ARM template
az group wait -g RG_NAME --created                   # Wait for creation

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script advertises optional deletion of unused Azure resources, but it never performs any delete operations. This is dangerous because operators may rely on the script for cleanup, believe resources were removed, and leave costly or exposed assets in place, creating operational and security risk through false assurance.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The delete-mode warning states that resources will be deleted, but the script only lists resources. Misleading destructive-action messaging can cause administrators to assume cleanup occurred and skip manual verification, leaving orphaned infrastructure, unnecessary cost, and potentially accessible resources behind.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The completion message falsely claims resources were deleted even though no deletion code exists. In an Azure management skill, this false success signal is particularly risky because users may trust automation for cloud hygiene and fail to remediate unused VMs, disks, or public IPs that remain active in the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.