Azure Ai Projects - Microsoft Foundry SDKs

v0.1.0

Build AI applications using the Azure AI Projects Python SDK (azure-ai-projects). Use when working with Foundry project clients, creating versioned agents with PromptAgentDefinition, running evaluations, managing connections/deployments/datasets/indexes, or using OpenAI-compatible clients. This is the high-level Foundry SDK - for low-level agent operations, use azure-ai-agents-python skill.

1· 1.9k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The SKILL.md is clearly an Azure AI Projects (Foundry) SDK reference and the code examples legitimately require Azure endpoints, model deployment names, and service connections. However the registry metadata declares no required environment variables/credentials while the instructions repeatedly reference AZURE_AI_PROJECT_ENDPOINT, AZURE_AI_MODEL_DEPLOYMENT_NAME and many connection-related env names (BING_CONNECTION_NAME, AI_SEARCH_CONNECTION_NAME, etc.). That metadata/instruction mismatch is incoherent and could mislead users about what credentials will be needed.
!
Instruction Scope
The instructions are extensive and within the SDK's stated purpose, but they instruct the agent/developer to: use DefaultAzureCredential (which will attempt multiple local credential sources, including Azure CLI, environment variables, and managed identities), upload files, create vector stores, enable CodeInterpreterTool (executes Python), and call OpenAI-compatible evals. Those operations can access local credentials or send uploaded data to external services. The SKILL.md does not restrict or warn about sensitive-data handling.
Install Mechanism
This is an instruction-only skill with no install spec or external downloads, so there is no additional install-time code or archive retrieval risk.
!
Credentials
Although registry metadata lists no required environment variables or primary credential, the documentation expects many env vars and uses DefaultAzureCredential. Requiring endpoint and deployment names (and connection names) is normal for this SDK, but the metadata omission is misleading and the DefaultAzureCredential behavior means local or cloud identity tokens could be used implicitly — this is a proportionality and transparency problem that raises risk if users assume no credentials are needed.
Persistence & Privilege
The skill does not request always:true and is user-invocable with normal autonomous invocation allowed. It does not declare any behavior that modifies other skills or system-wide settings. No persistence or elevated privilege requests are present in the package.
What to consider before installing
This skill appears to be documentation for the Azure AI Projects Python SDK and the code examples are plausible for that purpose — but be aware of two practical issues before installing/using it: 1) Metadata mismatch: the registry metadata claims no required environment variables, but the SKILL.md expects AZURE_AI_PROJECT_ENDPOINT, AZURE_AI_MODEL_DEPLOYMENT_NAME and various connection env names. Expect to provide Azure endpoints/connections and verify which secrets are actually required. 2) Credential exposure: examples use DefaultAzureCredential, which will try local credentials (Azure CLI tokens, environment variables, managed identities). Only run this skill in environments where those credential sources are safe to use. If you have sensitive Azure credentials on the host, be cautious. 3) Data handling and tools: examples show uploading files, creating vector stores, using CodeInterpreterTool (executes Python), and calling OpenAI-compatible evals — uploaded or evaluation data may be transmitted to external services. Don’t upload sensitive files or enable code-execution tools in untrusted contexts. 4) Source and provenance: the skill lists no homepage and source is unknown. Consider obtaining the official SDK docs or a skill from a trusted publisher, and verify required env vars and intended behavior before use. If you want to proceed, confirm which environment variables you will set, review the DefaultAzureCredential auth flows you expose, and avoid uploading or evaluating any sensitive data until you’re confident about where it will be sent and who can access it.

Like a lobster shell, security has layers — review code before you run it.

latestvk9777p20df5r2e2dw3g9cfqqjx8089ew

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments