Security audit

Azure Cli Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This Azure administration skill is mostly coherent, but it includes high-impact VM deletion and stopping examples without enough scoping, preview, or confirmation guidance.

Install only if you intend to let an agent help administer Azure resources. Before using it, require the agent to show the exact subscription, resource group, and resource IDs, avoid running delete or stop commands without explicit approval, and prefer managed identity or Key Vault-backed secrets over exported long-lived credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation guidance is overly broad and frames the skill as usable whenever efficiency, automation, batch processing, or workflow optimization is desired. In an agent ecosystem, that can cause the skill to be selected for generic tasks, unexpectedly granting it access to read/exec/write capabilities and cloud-management behaviors outside the user’s actual intent.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill includes destructive commands for deleting VMs and stopping running resources, but does not pair them with prominent warnings, dry-run guidance, scope validation, or confirmation requirements. In an agent context, examples often become executable suggestions, so this materially raises the risk of accidental production outages, data loss, and cost-impacting operational disruption.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The authentication examples normalize direct handling of sensitive credentials and access tokens in shell commands without strong warnings about secret exposure, shell history leakage, process inspection, or log capture. Because this skill is designed for automation and exec-capable agents, unsafe credential-handling patterns are more dangerous: they can propagate into scripts, CI logs, or agent traces.

Static analysis

No suspicious patterns detected.