agent-bom discover azure

• Outcome: Pass
• Latest audit: Nov 2, 2026 · 7:24 PM UTC
• Version: 0.113.0

Overview

The skill describes a controlled, read-only Azure inventory workflow, though its required discovery script is absent from the reviewed package.

Use a read-only identity scoped to the intended subscriptions and protect inventory files as sensitive infrastructure information. Obtain and review the missing adapter from a trusted source before running it; its actual credential handling, redaction, and network behavior were outside this package's review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

credential_handling: "Credentials stay in the operator environment. The skill invokes Azure SDK discovery locally and writes canonical inventory JSON with source_type=skill_invoked_pull. agent-bom receives sanitized inventory only when the operator explicitly scans or pushes that inventory."
    data_flow: "Operator Azure subscription -> read-only Azure SDK calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.azure/azureProfile.json"
      - "~/.azure/config"
      - "~/.azure/msal_token_cache.json"
    file_writes:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

data_flow: "Operator Azure subscription -> read-only Azure SDK calls -> canonical inventory JSON -> optional local agent-bom inventory scan. No agent-bom-hosted service is required. Credential-like values are redacted before persistence/export."
    file_reads:
      - "~/.azure/azureProfile.json"
      - "~/.azure/config"
      - "~/.azure/msal_token_cache.json"
    file_writes:
      - "operator-selected inventory JSON output path"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

file_reads:
      - "~/.azure/azureProfile.json"
      - "~/.azure/config"
      - "~/.azure/msal_token_cache.json"
    file_writes:
      - "operator-selected inventory JSON output path"
    network_endpoints:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

## Guardrails

- Use only operator-approved Azure subscriptions and read-only identities.
- Do not request or display raw `AZURE_CLIENT_SECRET`, access tokens, or
  connection strings.
- Do not modify Azure resources. This workflow is discovery-only.
- Write inventory only to a path the operator chose.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

- python
      env: []
      credentials: azure-read-only
    credential_policy: "Use the operator's existing Azure identity chain. Prefer Azure CLI, workload identity, managed identity, or short-lived service principal credentials. Do not ask users to paste client secrets. Do not print credential values."
    optional_env:
      - AZURE_SUBSCRIPTION_ID
      - AZURE_TENANT_ID

Static analysis

No suspicious patterns detected.