Azure Cloud Architect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 1.0.5

Overview

This Azure CLI skill is mostly purpose-aligned but asks for broad execution and write authority while also containing unrelated generic file/API automation instructions.

Review before installing. Use it only with a least-privileged Azure account and a sandboxed agent environment, and require explicit confirmation before any write, delete, RBAC, subscription-switching, or cross-subscription operation. Treat the generic file/API automation sections as out of scope unless the publisher narrows and documents them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:31

Finding

Overly Broad Agent Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–34
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: Medium

Vulnerable Configuration

yaml

tools:
- read
- exec
- write

The skill also describes generic file processing, external API integration, and system-command execution capabilities at lines 291–295 and 331–335, although its stated purpose is Azure infrastructure management through the Azure CLI.

Technical Analysis

The skill receives unrestricted read, write, and exec capabilities. Its legitimate Azure architecture workflows primarily require execution of Azure CLI commands and processing of their output. The configuration does not define:

• Filesystem path restrictions for reading or writing.
• An allowlist of permitted executables or Azure CLI subcommands.
• Restrictions that make Azure operations read-only by default at the tool-enforcement layer.
• Network destination controls for the advertised API integration capability.
• A separate approval boundary for accessing local files unrelated to Azure operations.

Although the skill text states that resource mutations require confirmation, this is a documentation-level instruction rather than a technical restriction on the granted tools. The exec and write permissions remain broadly available to the agent. Consequently, prompt manipulation, ambiguous user instructions, or untrusted command output could induce operations outside the skill's intended Azure-management boundary.

No evidence was found that the skill actively exploits these permissions, steals credentials, or executes a malicious payload. The vulnerability is the excessive privilege boundary itself.

Attack Path

1. A user loads the skill, granting it read, write, and exec tools.
2. The agent processes a crafted Azure-related request or untrusted content presented as operational instructions.
3. The c ...[truncated 1499 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the write capability unless a documented workflow strictly requires local file modification.
2. Restrict file reads and writes to explicit, user-approved paths inside a dedicated workspace.
3. Constrain command execution to the Azure CLI executable and an allowlist of required subcommands.
4. Enforce read-only Azure commands by default through technical policy rather than relying only on natural-language instructions.
5. Require scoped, explicit confirmation immediately before every filesystem write, Azure mutation, or non-read-only command.
6. Run the skill under a dedicated low-privilege operating-system account and a minimally privileged Azure identity.
7. Apply Azure RBAC at the narrowest practical subscription, resource-group, or resource scope.
8. Block generic outbound network access and allowlist only required Azure management endpoints.
9. Remove unsupported generic file-processing and API-integration claims, or document and constrain each required capability.
10. Log tool invocations with secret redaction and record the executable, arguments, target subscription, affected resources, and approval event.
11. Treat Azure CLI output and user-supplied resource metadata as untrusted data that must never be interpreted as agent instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation language is overly broad, describing use for general efficiency, automation, batch processing, and workflow optimization rather than tightly scoped Azure architecture tasks. Overbroad triggering can cause the skill to be selected for unrelated requests, exposing exec/write-capable functionality in contexts where users did not intend cloud-affecting automation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill states it is 'default read-only' and requires explicit confirmation before write or destructive actions, yet the manifest exposes both exec and write capabilities without any enforceable constraints in the declared interface. This mismatch can cause an agent or orchestrator to grant broader permissions than users expect, increasing the chance of unintended infrastructure changes or destructive Azure CLI execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document claims the skill only supports Azure CLI commands, but later expands its scope to generic file processing and external API integration. This inconsistency weakens trust boundaries and may cause the agent to invoke broader behaviors than intended, including non-Azure file or network operations that are not covered by the earlier safety assumptions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Large portions of the file describe unrelated generic file handling, API calls, and command execution instead of a narrowly scoped Azure CLI assistant. That scope drift makes the skill more likely to activate in unrelated contexts and gives cover for broader execution and data-handling behaviors than users would expect from the title and summary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown advertises file write, API integration, and command execution capabilities, but does not pair them with prominent user-facing warnings, consent boundaries, or operation limits. In a skill that already has exec/write tools and cloud-management framing, that omission increases the risk of unsafe file modifications, external data transmission, or command execution beyond user expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.