Security audit

azure-infra

Security checks for vulnerabilities and agentic risk

Overview

This Azure skill is mostly transparent, but it asks for powerful local and cloud-management authority while also describing broad file, API, and callback capabilities that are not clearly scoped to Azure work.

Install only if you are comfortable letting an agent run Azure CLI commands under your current Azure login. Keep use limited to Azure resource queries unless you explicitly review the full command, target subscription/resource, and impact before any change. Do not use it to retrieve secret values, and treat the generic file, API, callback, and API-key sections as insufficiently scoped unless the publisher narrows them.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill explicitly states that Key Vault secret values must not be shown, but later guidance tells users to use `az keyvault secret show` to retrieve the value. In a skill that can execute local Azure CLI commands, this contradiction can normalize or enable secret exfiltration, especially if an agent follows the later instruction without additional guardrails.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as an Azure infrastructure assistant, but later sections claim broad file processing, API integration, and generic command execution capabilities unrelated to that scope. This kind of scope drift is dangerous because it can justify execution paths beyond the user’s reasonable expectation, increasing the chance that the skill is invoked for arbitrary local actions instead of tightly constrained Azure CLI tasks.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Advertising generic file read/parse/write capability is not justified by the stated Azure infrastructure purpose and can expand the effective attack surface of the skill. In an agent environment with `read`, `write`, and `exec` tools, this can enable unintended local file access or modification under the cover of an Azure-focused workflow.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The documentation advertises standard external API integration even though the skill is described as operating through the local Azure CLI. That mismatch can permit or encourage outbound requests to non-Azure services, creating additional data-exfiltration and trust-boundary risks that users would not expect from an Azure CLI management skill.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger conditions are broad and based on generic Azure-related keywords, without strong scope boundaries. In a powerful skill that can execute commands, broad activation increases the risk of the skill being selected for loosely related requests and performing sensitive Azure-environment actions in contexts where a narrower tool should have been used.

Static analysis

No suspicious patterns detected.