ClawHub
Back to skill

Security audit

Azure Cli Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Azure CLI helper, but it gives an agent broad cloud-management authority and includes unsafe installation and destructive-operation examples without enough guardrails.

Review this skill before installing. Use it only with an Azure account or service principal that has the minimum permissions needed, do not paste real secrets into prompts, confirm the subscription and resource identifiers before any create/delete/stop/upload command, and avoid the Linux curl-to-bash install path unless you independently verify the installer through official Microsoft package guidance.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:207
Finding

Unverified Remote Installer Executed Through a Shell Pipeline

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 207
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code:

bash
curl -sL https://aka.ms/InstallAzureCliLinux | bash

Technical Analysis

The Linux installation instructions download a shell script from an external URL and pipe the response directly into bash. The aka.ms address is a redirect whose final destination and returned content are controlled remotely and can change after the Skill has been reviewed.

The command does not pin an installer version, verify the final URL, validate a published checksum or cryptographic signature, or provide an inspection step before execution. The -s option also suppresses normal transfer output, reducing visibility into the retrieval process. Although the URL is associated with Microsoft and installing Azure CLI supports the Skill's declared functionality, source reputation does not eliminate the risks inherent in executing mutable remote content.

This execution mechanism exceeds the minimum privileges necessary for documenting or installing the dependency safely. Azure CLI can instead be installed through a signing-key-verified package repository or through a separately downloaded and authenticated artifact.

Attack Path

  1. A user or execution-capable Agent follows the Linux installation instructions.
  2. curl follows redirects from https://aka.ms/InstallAzureCliLinux.
  3. The remotely supplied response is passed directly to bash.
  4. If the redirect, hosting infrastructure, upstream script, or relevant transport trust chain has been compromised, substituted shell commands execute immediately.
  5. The payload operates with the privileges of the invoking process and may gain broader system access if the installer invokes sudo or causes the user to approve elevation.

Impact Assessment

A substituted payload could execute arbitrary com ...[truncated 764 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | bash pipeline.
  2. Prefer Microsoft's repository-based installation process with a repository signing key whose fingerprint is independently verified.
  3. Pin the Azure CLI package or installer to an approved version where operationally feasible.
  4. If a script-based installation is unavoidable:
    • Resolve and allowlist the expected final HTTPS host.
    • Download the installer to a local file without executing it.
    • Verify a publisher-provided cryptographic signature or checksum obtained through an independent trusted channel.
    • Review the downloaded content before execution.
    • Run it with the least-privileged account possible.
    • Avoid elevation unless a documented installation step strictly requires it.
    • Delete the installer after successful verification and use.
  5. Require explicit user confirmation before an Agent installs dependencies or performs any privileged operation.
  6. Document the expected package source, version, signing identity, and files or system settings the installation modifies.
  7. For Azure operations with destructive effects, such as resource-group deletion, require explicit confirmation and display the target subscription and resource identifiers before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The instruction to fetch a remote script with curl and pipe it directly to bash executes unverified code from the network immediately, bypassing inspection and integrity checks. In an agent context, this is especially risky because the agent may run the command non-interactively, enabling supply-chain compromise or arbitrary code execution if the remote content is malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

Linux (Ubuntu/Debian):

bash
curl -sL https://aka.ms/InstallAzureCliLinux | bash

Windows:

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The shell pipeline chaining remote content into bash is a classic command-chaining abuse pattern because it turns network input directly into executable shell instructions. This materially increases exploitability: any compromise of the remote endpoint, redirect, or transport trust results in immediate arbitrary command execution on the host running the skill.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

Linux (Ubuntu/Debian):

bash
curl -sL https://aka.ms/InstallAzureCliLinux | bash

Windows:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The authentication section instructs users to log in and manage subscriptions but omits guidance on protecting credentials, avoiding secret disclosure in logs, and using least-privilege identities. Because the skill is meant for agent/tool execution, missing secret-handling safeguards can lead to accidental exposure of Azure credentials or misuse of privileged accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly includes destructive Azure operations such as resource group deletion without any confirmation guidance, rollback notes, or warning about irreversible cloud-side effects. In an agent-executed context, this increases the chance that a user or downstream agent triggers deletion of live resources, causing service disruption or data loss.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
az storage account list

# 上传文件到 Blob
az storage blob upload \
  --account-name mystorage \
  -c mycontainer \
  -n myfile.txt \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description, headings, and operating instructions are all presented in Chinese, and the file does not indicate that language selection is optional or that the skill is intentionally restricted to a Chinese-language audience. This is a natural-language policy issue because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.