T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:33- Finding
Excessive Tool Permissions and Activation Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
azure-infra-free
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a read-only Azure inventory helper, but it asks for unnecessary write authority and contains broad, conflicting instructions that should be reviewed before installation.
Install only if you are comfortable with a command-capable skill using your local Azure CLI login. Treat it as needing review: remove or deny write access if possible, keep use limited to explicit read-only Azure inventory or health-check questions, and prefer commands that pass --subscription directly instead of changing the saved Azure CLI default subscription.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:86- Finding
Read-Only Guarantee Contradicted by Persistent Azure CLI Context Modification
- Content
View full analysis
` to switch the target subscription. When query results involve subscription scope, explicitly identify the subscription used. ``` The same state-changing command is recommended again in the error handling and FAQ sections: ```text `az account list` confirms available subscriptions, then use `az account set` to switch. ``` ```text Use `az account list -o table` to view all subscriptions, execute `az account set --subscription ` to switch, and then run the query command. ``` ### Technical Analysis The Skill states that all operations are read-only. However, `az account set --subscription ` modifies the Azure CLI's persistent local default-subscription context. It does not change an Azure cloud resource, but it changes local state that affects subsequent Azure CLI commands in the same environment. This creates a context-confusion risk, especially in shared terminals, long-running Agent environments, or workflows where later commands rely implicitly on the default subscription. The document does not require explicit confirmation, validate the requested subscription against the authenticated account's available subscriptions, preserve the previous context, or restore it after the query. If a future workflow contains a write-capable Azure command outside this Skill, the changed default context could cause that operation to target a different subscription than the operator intended. ### Attack Path 1. An attacker or mistaken user supplies a subscription identifier and asks the Skill to query it. 2. The Skill executes `az account set --subscription `. 3. The Azure CLI default subscription i ...[truncated 967 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill claims all operations are read-only, yet its declared tools include write capability. In an agent setting, tool declarations often determine what the runtime may permit, so this mismatch can enable state-changing behavior despite the natural-language policy saying otherwise.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A trigger condition that activates for generic Operations-related tasks is too broad for a skill that can execute commands. Over-broad activation increases the chance the agent routes unrelated requests into this skill, where command execution and Azure-context actions may occur without sufficiently specific user intent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill repeatedly states that the free version excludes security auditing, but later content claims it provides automated security audit functionality. This inconsistency can mislead the agent or user about the skill’s actual scope and may cause it to be invoked for sensitive security-review tasks it was not meant or validated to perform.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a narrowly scoped, read-only Azure query skill, but later sections advertise generic file processing, external API integration, and command execution. This broadens the apparent authority of the skill beyond its declared purpose, increasing the chance of unsafe invocation, unexpected data handling, or misuse of available tools.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The invocation guidance is directionally correct but lacks a concrete bounded trigger list and negative examples. That ambiguity makes accidental overuse more likely, especially because the file elsewhere contains inconsistent claims about broader capabilities.
- Content
Static analysis
No suspicious patterns detected.