Azd Deployment for Azure

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:11 AM UTC
• Version: 0.1.0

Overview

This is legitimate Azure deployment guidance, but it includes cloud-changing commands and a persistent registry credential pattern that users should review before use.

Install only if you are comfortable reviewing Azure deployment templates and hooks before running them. Confirm the Azure tenant, subscription, resource group, environment, costs, and every RBAC assignment before azd up or azd provision. Prefer managed identity with least-privilege AcrPull over ACR admin passwords/listCredentials, avoid exposing azd env get-values output in shared logs or chat, and treat env delete or rm -rf .azure/<env-name> as last-resort reset commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to run `azd init`, `azd env new`, and especially `azd up`, which provisions infrastructure and deploys code, but it does not explicitly warn that these commands will create or modify Azure resources and may incur cost or alter production environments. In an agent context, omission of such guardrails increases the chance of unintended infrastructure changes when the skill is invoked automatically or by an inexperienced user.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented commands include `azd env get-values`, which can print environment variables that may contain secrets, endpoints, or other sensitive configuration to the terminal, logs, or chat transcripts. Without a warning, users or agents may expose credentials or sensitive service metadata unintentionally during troubleshooting or automation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document provides end-to-end deployment steps that will provision infrastructure and modify Azure resources, but it does not clearly warn users that running these commands can create billable resources and change cloud state. In a deployment skill, omission of explicit safety/approval guidance increases the chance of unintended privileged actions, especially when users may copy-paste commands directly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The hook examples perform RBAC role assignment changes automatically, granting identities access to Azure resources, but they do so without a user-facing warning or approval checkpoint. This is dangerous because role assignments are privileged, persistent changes that can broaden access if applied to the wrong principal, scope, or environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example explicitly enables the ACR admin user and presents it as required, normalizing long-lived shared registry credentials without any warning. In deployment guidance, this can lead users to adopt a weaker authentication model, expanding blast radius if credentials are exposed and making credential rotation/auditing harder.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The sample retrieves registry credentials via listCredentials() and injects them into Container App secrets without explaining the sensitivity of those credentials or safer alternatives. Although secrets storage is supported, the pattern encourages use of broad shared credentials in infrastructure code and can propagate insecure copy-paste into production deployments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide includes destructive reset commands (`azd env delete`, `rm -rf .azure/<env-name>`) without an explicit warning that they permanently remove local environment state and can disrupt active deployments or cause accidental data/configuration loss. In a troubleshooting document, users may copy-paste commands quickly, so lack of cautionary context increases the chance of unsafe execution.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: references/acceptance-criteria.md:279

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: references/azure-yaml-schema.md:273

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:248