Security audit

Azure Cloud Architect

Security checks across malware telemetry and agentic risk

Overview

The skill is not malicious, but it gives an agent broad local and Azure CLI authority while also containing poorly scoped generic file and API instructions.

Review this skill before installing. Use it only with least-privilege Azure accounts, confirm the exact tenant, subscription, resource group, and command before any change, and treat the generic API, callback, and file-write sections as out of scope unless the publisher documents them precisely. Protect Azure CLI session credentials and avoid pasting secrets from command output into chat or logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill claims writes and destructive actions require explicit confirmation, but the manifest exposes unrestricted exec and write tools with no enforceable guardrail in the skill itself. In an agent environment, users or downstream prompts may trust the documented safety model and invoke the skill in ways that can still perform state-changing local or Azure-side actions immediately.

Intent-Code Divergence

Medium

Confidence: 78% confidence
Finding: The document says the skill only supports Azure CLI commands, yet elsewhere advertises generic file handling and external API integration. That mismatch broadens the apparent authority of the skill and can mislead an agent or operator into using non-Azure capabilities that increase attack surface, including filesystem and network-adjacent actions unrelated to the stated purpose.

Context-Inappropriate Capability

Low

Confidence: 72% confidence
Finding: Advertising generic file read/write capability is risky because it is not justified by the Azure-architecture use case and pairs with the declared write tool permission. In context, this could enable modification of local files, configs, scripts, or logs beyond Azure management tasks, increasing the chance of unintended data loss, persistence, or secret exposure.

Context-Inappropriate Capability

Low

Confidence: 69% confidence
Finding: Advertising external API integration beyond Azure CLI is not justified by the skill's stated purpose and expands the operational surface. In practice, this can enable unreviewed outbound data transfers or interactions with third-party services, which is especially sensitive in a cloud administration context where outputs may contain inventory, RBAC, or cost data.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation language is excessively broad, describing generic efficiency, automation, batch processing, and workflow optimization use cases. That makes accidental or overly frequent invocation more likely, which is dangerous here because the skill has exec and write capabilities and operates in a privileged cloud-management context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.