Azure Cli Toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

This Azure administration skill contains powerful cloud commands, but its examples are under-scoped and include unsafe credential handling and destructive operations without clear guardrails.

Install only if you are comfortable reviewing and controlling every Azure command before execution. Use least-privilege identities, explicit tenant/subscription/resource-group scopes, avoid printing or passing secrets through logs or command arguments, and require manual confirmation before any delete, network exposure, or cross-subscription operation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:73

Finding

Confirmation-Free Bulk Deletion of Azure Virtual Machines

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 73
Vulnerability Type: Unsafe destructive cloud operation
Risk Level: High

Vulnerable code:

bash

az vm list -g myRG -d --query "[].id" -o tsv | xargs az vm delete --ids --yes

Technical Analysis

The command enumerates every virtual machine in the specified resource group and pipes the resulting resource IDs directly into az vm delete. The --yes option suppresses Azure CLI's interactive confirmation.

The operation has no preview stage, explicit subscription selection, resource allowlist, backup verification, resource-lock check, or separate user approval step. It also relies on the Azure CLI's currently active subscription, which may differ from the subscription intended by the user.

Because this Skill is designed to be followed by an AI Agent with command-execution access, an ambiguous request or stale Azure context could result in immediate deletion of unintended resources.

Attack Path

1. An Agent is authenticated to Azure using an identity with permission to delete virtual machines.
2. The active Azure CLI subscription points to a production or otherwise unintended subscription.
3. A user requests a bulk cleanup operation, or an attacker supplies misleading resource-group information through untrusted task input.
4. The Agent follows the documented pipeline and enumerates all virtual machines in the selected resource group.
5. xargs passes the resource IDs directly to az vm delete.
6. The --yes flag bypasses confirmation, causing the selected virtual machines to be deleted immediately.

Impact Assessment

Exploitation requires an Azure identity with virtual-machine deletion privileges. Within that identity's authorized scope, the operation can cause permanent workload removal, service outages, loss of ephemeral data, and recovery costs. If the identity has Contributor-level access at subscription scope, the potenti ...[truncated 65 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit tenant, subscription, resource-group, and resource-ID parameters for every destructive operation.
• List the exact resources selected for deletion and obtain explicit user confirmation before executing the delete command.
• Remove --yes from general-purpose examples. Permit it only after a separately recorded approval step.
• Validate that the active subscription matches an approved subscription allowlist.
• Check resource locks, backup status, recovery requirements, and environment tags before deletion.
• Replace the direct pipeline with a controlled script that handles empty input, validates every resource ID, and records an audit log.
• Use an Azure identity scoped only to the resource group required for the task.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:92

Finding

Deployment Example Exposes SSH to All Source Addresses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 92-98
Vulnerability Type: Overly permissive network security rule
Risk Level: High

Vulnerable code:

bash

az network nsg rule create -g prod-rg --nsg-name prod-nsg \
  -n allow-ssh --priority 1000 \
  --source-address-prefixes '*' \
  --destination-port-ranges 22 \
  --access Allow --protocol Tcp

Technical Analysis

The network security group rule permits inbound TCP traffic to port 22 from *, representing every source address. The example is presented as part of a production deployment and does not constrain access to an administrative network, VPN, private endpoint, or approved IP range.

If the NSG is associated with a publicly reachable network interface or subnet, the rule exposes the SSH service to Internet scanning, credential attacks, and exploitation of vulnerabilities in the SSH daemon or authentication configuration.

Attack Path

1. An Agent executes the documented deployment commands.
2. The Agent creates the allow-ssh NSG rule with an unrestricted source prefix.
3. The NSG is associated with a subnet or network interface containing a virtual machine with a public IP address.
4. An external attacker discovers port 22 through Internet-wide scanning or targeted enumeration.
5. The attacker attempts credential stuffing, brute-force authentication, stolen-key use, or exploitation of an SSH-related vulnerability.
6. If successful, the attacker obtains operating-system access under the compromised SSH account and may attempt lateral movement using the VM's network position or managed identity.

Impact Assessment

The rule itself does not grant Azure privileges, but it exposes the protected host to arbitrary remote connection attempts. Successful compromise could provide the attacker's SSH account privileges on the virtual machine. The scope can expand if the host contains credentials, has access to private service ...[truncated 44 chars]

Remediation

View remediation

Remediation Suggestions

• Replace * with explicit, approved administrative CIDR ranges.
• Prefer Azure Bastion, private connectivity, VPN access, or just-in-time virtual-machine access instead of public SSH.
• Do not assign public IP addresses to administrative endpoints unless strictly necessary.
• Enforce SSH key authentication and disable password authentication and direct root login.
• Add Azure Policy controls that deny NSG rules exposing administrative ports to the Internet.
• Verify NSG associations and effective security rules after deployment.
• Add an automatic expiration process for any temporary administrative-access rule.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:103

Finding

Unrestricted Iteration Across Every Accessible Azure Subscription

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-108
Vulnerability Type: Missing subscription boundary and context validation
Risk Level: Medium

Vulnerable code:

bash

az account list --query "[].{name:name, id:id, state:state}" -o table
for sub in $(az account list --query "[].id" -o tsv); do
  az account set --subscription $sub
  echo "=== 订阅: $(az account show --query name -o tsv) ==="
  az vm list -o table
done

Technical Analysis

The loop enumerates and activates every subscription visible to the current identity. It does not use a subscription allowlist, verify tenant boundaries, restore the original context, or require approval before switching contexts.

Although the illustrated command only lists virtual machines, it establishes a pattern in which subsequent Azure CLI commands execute against whichever subscription was most recently selected. When combined with the Skill's destructive and resource-creation commands, stale context can cause operations to affect the wrong subscription.

Attack Path

1. The Agent authenticates using an identity that can access multiple Azure subscriptions.
2. The loop retrieves all visible subscription IDs rather than a user-approved subset.
3. The Agent sequentially changes the global Azure CLI context with az account set.
4. The loop ends while one of the enumerated subscriptions remains active.
5. A later deployment, firewall modification, stop, or deletion command is executed without an explicit --subscription argument.
6. The later command affects the remaining active subscription instead of the subscription intended by the user.

Impact Assessment

The loop cannot exceed the permissions already assigned to the authenticated identity. However, it broadens the operational scope from one intended subscription to every subscription accessible by that identity. Resulting exposure includes cross-subscription resource invent ...[truncated 92 chars]

Remediation

View remediation

Remediation Suggestions

• Require an explicit allowlist of tenant and subscription IDs.
• Pass --subscription directly to each Azure CLI command instead of relying on mutable global context.
• Verify and display the tenant, subscription, resource group, and target resources before every modifying command.
• Separate inventory credentials from deployment or deletion credentials.
• Restore the original Azure CLI context after any controlled iteration.
• Require separate approval before crossing subscription or tenant boundaries.
• Record subscription context in audit logs for every cloud mutation.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:133

Finding

Service Principal Creation Without Explicit Least-Privilege Role or Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 133-136
Vulnerability Type: Overprivileged automation identity creation
Risk Level: High

Vulnerable code:

bash

az ad sp create-for-rbac --name my-automation-sp
export AZURE_CLIENT_ID="<appId>"
export AZURE_CLIENT_SECRET="<password>"
export AZURE_workspace_id="<tenant ID>"

Technical Analysis

The command creates a service principal for role-based access control without explicitly defining the minimum required role or resource scope. The surrounding instructions position this identity as a general automation credential capable of deployment, network modification, multi-subscription management, and destructive bulk operations.

Omitting explicit role and scope controls can result in privileges broader than the task requires, depending on Azure CLI behavior, caller privileges, and environment configuration. The Skill also fails to recommend separate identities for read-only auditing, deployment, and destructive administration.

Attack Path

1. A privileged Azure administrator follows the setup instructions.
2. The service principal is created without a task-specific custom role and narrow resource scope.
3. The generated client secret is configured in an automation environment or Agent session.
4. The credential is exposed through logs, environment access, process arguments, or another compromise.
5. An attacker authenticates as the service principal.
6. The attacker performs any Azure action permitted by the assigned role, potentially including resource creation, modification, stopping, or deletion throughout the assigned scope.

Impact Assessment

The exact privilege level depends on the role assignment produced in the deployment environment. The potential scope includes the subscription or resource hierarchy to which the service principal is assigned. If granted Contributor-equivalent access at subscription s ...[truncated 202 chars]

Remediation

View remediation

Remediation Suggestions

• Specify an explicit least-privilege role and resource-level scope when creating the service principal.
• Create custom Azure roles containing only the actions required by the automation task.
• Use separate identities for read-only auditing, deployment, cost analysis, and destructive operations.
• Prefer workload identity federation or managed identity over long-lived client secrets.
• Apply credential expiration, rotation, conditional-access controls where supported, and sign-in monitoring.
• Restrict destructive privileges to short-lived, approval-gated workflows.
• Document the exact permissions and scope granted by every setup command.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:63

Finding

Service Principal Secret Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-67
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: High

Vulnerable code:

bash

az login --service-principal \
  --username $AZURE_CLIENT_ID \
  --password $AZURE_CLIENT_SECRET \
  --workspace $AZURE_workspace_id

Technical Analysis

The login example expands the service principal secret into the command's argument list. Depending on operating-system protections, shell tracing, Agent telemetry, process monitoring, command-history behavior, and CI/CD logging, the expanded secret may be visible to other processes or retained in logs and transcripts.

The variables are also unquoted, which can cause shell word splitting or wildcard expansion if a value contains special characters. The same file demonstrates a stdin-based login form, but it does not make that safer form mandatory.

Attack Path

1. A valid service principal secret is loaded into AZURE_CLIENT_SECRET.
2. An Agent or automation runner executes the documented command.
3. The shell expands the secret into the Azure CLI process arguments.
4. Process inspection, shell tracing, command telemetry, debugging output, or CI/CD logging captures the argument.
5. An attacker with access to that output obtains the client ID, tenant context, and secret.
6. The attacker authenticates as the service principal and exercises its assigned Azure permissions until the credential expires or is revoked.

Impact Assessment

A leaked secret grants the privileges assigned to the service principal. The affected scope may range from one resource group to multiple subscriptions, depending on its role assignments. Potential consequences include cloud-resource enumeration, resource modification or deletion, network changes, service disruption, and access to data available to the identity.

Remediation

View remediation

Remediation Suggestions

• Prefer Azure managed identity or workload identity federation so no reusable client secret is needed.
• If secret authentication is unavoidable, use the documented stdin mechanism or another protected secret channel rather than command arguments.
• Quote every shell variable and disable shell tracing before handling credentials.
• Configure the Agent and CI/CD platform to redact Azure credentials from commands, logs, and transcripts.
• Restrict access to process metadata and build logs.
• Rotate the service principal secret immediately if exposure is suspected.
• Use short-lived credentials and narrowly scoped role assignments to reduce the impact of disclosure.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:233

Finding

Key Vault Secret Printed Directly to Standard Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 233-234
Vulnerability Type: Plaintext secret disclosure in command output
Risk Level: High

Vulnerable code:

bash

az keyvault secret show --vault-name myVault -n azure-client-secret \
  --query value -o tsv

Technical Analysis

The command retrieves only the Key Vault secret value and emits it as plaintext to standard output. In an AI Agent, terminal session, CI/CD runner, or support workflow, standard output may be copied into transcripts, centralized logs, command results, or diagnostic records.

Although retrieving a secret is a legitimate operation, displaying it directly is unnecessary when the goal is to authenticate another process. The command should pass the value through a protected secret channel without rendering it in human-readable output.

Attack Path

1. The Agent executes the documented Key Vault command using an identity permitted to read the secret.
2. Azure CLI returns the secret value as unformatted plaintext.
3. The Agent platform, terminal recorder, CI/CD system, or logging layer stores standard output.
4. An attacker or unauthorized operator gains access to the retained output.
5. The attacker uses the disclosed client secret with the corresponding service principal identifier.
6. The attacker obtains all Azure access granted to that service principal until the secret is revoked or expires.

Impact Assessment

Disclosure compromises the confidentiality of the retrieved secret. If the value is an Azure service principal credential, the attacker gains that identity's assigned privileges and scope. The result may include unauthorized Azure API access, resource discovery, workload modification, destructive actions, or access to other secrets and data available to the identity.

Remediation

View remediation

Remediation Suggestions

• Do not print secret values to terminal output, Agent responses, logs, or transcripts.
• Prefer managed identity or workload identity federation over retrieving reusable secrets.
• Pass secrets directly to the consuming process through a protected secret-injection mechanism.
• Mark secret-handling steps as non-logging and configure automatic output redaction.
• Limit Key Vault secret-read permissions to the exact identity and secrets required.
• Enable Key Vault diagnostic monitoring and alert on unusual secret retrieval.
• Rotate any secret that has appeared in retained output and remove affected logs under the organization's incident-response policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill documents a bulk deletion command that pipes VM IDs directly into az vm delete --yes without an explicit warning, preview step, or confirmation requirement. In the context of a cloud-admin skill with exec capability, this is highly dangerous because it enables irreversible, large-scale destruction of production resources from a loosely scoped pattern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented response schema describes grading and audit-style output that does not match the skill's stated Azure administration purpose. This mismatch can mislead an agent into using the skill in the wrong context, increasing the chance of unsafe automation, incorrect tool chaining, or treating destructive cloud actions as harmless analysis tasks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples show code-review style inputs and outputs instead of Azure management behavior, contradicting the skill's claimed functionality. In agent environments, examples strongly shape invocation behavior, so this inconsistency can cause the skill to activate on unrelated prompts or obscure that it may execute privileged cloud commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad enough to match generic efficiency, automation, or workflow-optimization requests, not just Azure administration tasks. In an agentic setting, over-broad routing can invoke a skill with exec/write capabilities in situations where it is unnecessary, expanding the chance of accidental command execution or privileged context misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown explicitly says the skill provides '中文交互' (Chinese interaction), which indicates a fixed language behavior. The file does not offer users a choice of language or explain a justified region-specific requirement, creating a language-policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instructions create a service principal and export its secret to environment variables without clearly emphasizing the sensitivity, privilege implications, and handling requirements of those credentials. In an agent ecosystem, such examples normalize exposing high-value secrets in shell history, logs, transcripts, or downstream tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The error-handling section discusses file/database ingestion and generic data-processing failures rather than Azure CLI or cloud API failure modes. This inconsistency reduces operator clarity during failure conditions and may cause an agent or user to apply the wrong recovery steps during privileged cloud operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.