Security audit

agent-framework-azure-ai-py

Security checks for vulnerabilities and agentic risk

Overview

This skill mixes a documentation-only description with broad read/write/command and cloud-agent instructions, so users should review its scope before installing.

Install only if you intend to use this as an active development/cloud-agent helper, not merely passive documentation. Use a least-privilege Azure account, expect possible network access and cloud costs, and review any proposed file writes or shell commands before allowing them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is presented as documentation-only, but the usage guidance explicitly instructs reading code, executing development operations, running checks, and handling runtime errors. This mismatch can mislead users and security controls into granting the skill a lower-trust profile while it actually encourages actions involving file I/O, code changes, and tool execution.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: Later sections advertise automated execution, file processing, API integration, and command execution despite the earlier documentation-only claim. This creates a trust-boundary deception issue: operators may enable the skill assuming passive documentation, while users are guided toward active behaviors that can affect local files, systems, or external services.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The embedded example demonstrates creating Azure agents with credentials, web search, hosted code tools, remote HTTP tooling, and live agent execution. In a file labeled documentation-only, this materially expands the apparent operational scope and may encourage deployment of credentialed remote tooling without the stronger warnings expected for executable or cloud-connected skills.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation description is broad, ambiguous, and spans AI model calls, dialogue, orchestration, and LLM application use without concrete boundaries. Overly general routing text increases the chance the skill is invoked in inappropriate contexts, including sensitive workflows where its nondeterministic or tool-using behavior may be unsafe.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The usage guidance tells users to call the skill with necessary parameters but does not clearly limit what the skill should or should not do. This kind of generic invocation language can normalize broad delegation to the skill, increasing the risk of unsafe or unintended operations when paired with declared tools like read, write, and exec.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The markdown describes writing code, reviewing/refactoring/testing, and running validation checks, which implies file modification, command execution, and external/tool activity, but does not place clear safety warnings next to those instructions. Users may follow these steps without understanding that the skill may alter code or trigger tool actions, especially because the document is framed as documentation-only.

Static analysis

No suspicious patterns detected.