Azure Identity Py

• Analyzed: May 12, 2026, 3:12 AM
• Findings: 0
• Version: 0.1.0
• Hash: b887c5b724394faa43ae290ede8b75b7f62a4f1ef49ed44640c6df91124029cc
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: azure-identity-py Version: 0.1.0 The skill bundle provides documentation and code examples for the `azure-identity` Python SDK. It instructs the agent to install the legitimate `azure-identity` package via `pip install`. The content describes standard practices for Azure authentication, including reading credentials from environment variables, which is appropriate for an identity library. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. All actions are clearly aligned with the stated purpose of facilitating Azure authentication.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

If used incorrectly, examples may authenticate as a powerful Azure user, CLI session, managed identity, or service principal.

Why it was flagged

The skill teaches use of Azure service principal secrets and local cached/logged-in Azure credentials. This is expected for Azure authentication, but it means code may act with the selected Azure identity's permissions.

Skill content

AZURE_CLIENT_SECRET=<your-client-secret> ... DefaultAzureCredential ... SharedTokenCacheCredential ... AzureCliCredential `az login`

Recommendation

Use least-privilege Azure identities, understand the DefaultAzureCredential order, exclude credential sources you do not want, and avoid exposing secrets in prompts, logs, or code.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Following the setup command installs the current package version from the Python package index, which may affect reproducibility or supply-chain review.

Why it was flagged

The skill instructs a user-directed package install without a version pin. This is normal for a Python SDK reference, but users should still verify and pin dependencies when appropriate.

Skill content

pip install azure-identity

Recommendation

Install from trusted package indexes and consider pinning a reviewed azure-identity version in production projects.