azure-infra

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.4

Overview

This Azure CLI helper is mostly coherent, but it asks for broad local read/write/command authority and includes generic file/API instructions that are not clearly limited to Azure work.

Review before installing. Use this only in a constrained environment where the agent may run Azure CLI commands against the intended subscription, preferably with Reader or narrowly scoped Azure RBAC. Require explicit approval for every write, destructive, IAM, billing, local file, callback, or non-Azure API action, and do not provide unrelated API keys or broad filesystem access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:30

Finding

Overprivileged Generic Tool Access Exceeds the Azure Management Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-33
Vulnerability Type: Excessive filesystem and command-execution permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec
  - write

The following supporting declarations in SKILL.md:349-353 broaden these capabilities beyond Azure CLI operations:

markdown

## Core Features
- **Automated execution**: Through local Azure
- **File processing**: Supports reading, parsing, and writing multiple file formats
- **API integration**: Processes responses through standardized calls to external services
- **Command execution**: Executes system commands in a secure sandbox and collects results
- **Information retrieval**: Quickly searches and filters target data

Technical Analysis

The Skill's stated purpose is to query and manage Azure resources through the local az command. However, it requests unrestricted generic read, write, and exec capabilities and advertises generic file processing, system command execution, and external API integration.

No command allowlist, filesystem path restriction, network destination restriction, or explicit prohibition against executing non-Azure commands is defined. The documented confirmation control applies primarily to Azure write and destructive operations; it does not clearly require confirmation before reading or modifying unrelated local files or running non-Azure operating-system commands.

This violates the principle of least privilege. A request interpreted as troubleshooting, file processing, or API integration could cause the agent to exercise permissions unrelated to Azure infrastructure management.

Attack Path

1. An attacker supplies an instruction containing Azure-related terminology so that the Skill is activated.
2. The instruction frames a local filesystem or operating-system action as necessary for Azure diagnostics, configuration processing, or ...[truncated 1551 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove read and write unless a documented Azure workflow strictly requires filesystem access.
2. Replace unrestricted exec with a constrained Azure CLI executor that permits only reviewed az subcommands and arguments.
3. Reject shell metacharacters, command substitution, pipelines, redirections, and chained commands when constructing CLI invocations.
4. Pass validated arguments directly to a process API rather than constructing shell command strings.
5. Restrict filesystem access to explicitly approved configuration and output directories, using canonical-path validation to prevent traversal.
6. Restrict outbound communication to documented Microsoft Azure endpoints; remove generic external API integration if it is unnecessary.
7. Extend the confirmation policy to all out-of-scope local reads, writes, command executions, and network requests—not only Azure resource changes.
8. Display the exact executable, argument array, target resources or files, network destination, and anticipated impact before approval.
9. Run the Skill in a sandbox with minimal filesystem permissions, restricted environment-variable access, and Azure RBAC roles limited to the required tasks.
10. Add explicit instructions prohibiting access to Azure CLI token caches, credentials, SSH keys, shell profiles, and unrelated project files.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

At L072, the skill states that it must not output or record any keys, secrets, tokens, or passwords and that Key Vault queries should show only secret names and metadata. However, L227 explicitly suggests using az keyvault secret show to view secret values, which directly contradicts the stated safety rule and normalizes secret retrieval within the skill documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Key user-facing fields such as displayName, summary, and most of the document content are presented in Chinese, but the file does not state that the skill is region-specific or give users a language option. Under the policy, a fixed language without opt-in can be a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger section says the skill activates when a user mentions Azure, az cli, Azure resource queries, or broad categories like virtual machines, storage, network, RBAC, and cost. This keyword-style activation lacks concrete constraints or negative examples beyond non-Azure clouds, so it may match ordinary discussion about Azure rather than clear invocation intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section expands the skill from Azure CLI infrastructure operations into generic file processing and external API integration, which is outside the declared scope. That kind of scope drift is dangerous because an agent may invoke broader read/write/exec behaviors than users expect, increasing the chance of unauthorized file access, unintended data exfiltration, or unsafe command execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Claiming generic file read/write support is not justified for an Azure infrastructure assistant and materially broadens what an agent may attempt locally. In a skill that already has read, write, and exec tools, this increases the risk of accessing or modifying sensitive local files unrelated to Azure management.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The external API integration claim is unrelated to the declared Azure CLI-only purpose and creates ambiguity about whether the skill may transmit data to arbitrary third-party services. That ambiguity is risky because cloud inventory, identities, logs, and configuration data are often sensitive, and unexpected API calls could become an exfiltration path.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This larger section documents workflows for generic file operations, API usage, output files, and broad command execution that are not justified by the skill’s stated Azure CLI purpose. In security terms, undocumented capability expansion can mislead users and downstream agents about trust boundaries, enabling abuse of read/write/exec permissions under the cover of an infrastructure helper.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The repeated feature block again claims generic file handling and API integration that do not match the Azure-focused purpose. Repetition makes the dangerous scope expansion more likely to be treated as intended behavior by an agent runtime, widening the operational surface beyond least privilege.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.