Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a read-only Azure CLI helper, but it needs review because it requests broader tool access than its stated purpose and under-explains an external callback path for Azure-related results.
Install only if you are comfortable letting the agent use your local Azure CLI session to list Azure subscriptions and resources. Avoid using callback_url unless you trust the destination and understand what data will be sent, and treat the skill as a read-only helper despite the manifest requesting write access and some documentation overstating security-audit features.
The invocation scope is described so broadly that an agent could treat almost any Azure-related user instruction as in-scope, increasing the chance of unintended command execution. In a skill with exec/write capabilities and account-context switching, vague triggers weaken guardrails and can cause actions to run in the wrong context or on overly broad requests.
The skill supports a callback_url parameter without warning that command results, subscription metadata, or other cloud inventory data may be sent to an arbitrary external endpoint. This creates a clear data exfiltration path, especially dangerous in an Azure environment where even 'read-only' output can reveal sensitive infrastructure details.
The ability-boundary section explicitly says the free edition does not include security auditing, NSG/storage/Key Vault checks, or security audit playbooks. Yet the feature comparison table later states '安全合规 | 内置安全检查', which directly contradicts those earlier limitations and overstates the actual intended capability.
The manifest and capability-boundary sections repeatedly state that the free version only supports read-only subscription navigation and resource inventory queries, and does not include RBAC auditing or security audit playbooks. However, the security section instructs users to run az role assignment list to verify role assignments, which is itself an RBAC audit capability reserved for the paid version per L188-L196.
The skill's display name, summary, and primary description are presented in Chinese, and the document does not indicate that users may choose another language. This can constitute a language-policy issue when a specific language is imposed without explicit user opt-in or documented locale justification.
The capability boundary explicitly states the skill does not support cross-subscription batch queries and requires manual switching. Later, the security guidance includes a dedicated row for '跨订阅操作安全' with RBAC validation guidance, which contradicts the declared unsupported scope by treating cross-subscription operations as an active skill concern.
No suspicious patterns detected.
