ClawHub
Back to skill

Security audit

Azure Ai Projects - Microsoft Foundry SDKs

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Azure SDK skill whose examples are aligned with building Azure AI Foundry projects, though users should handle uploads and credentials carefully.

Install this as Azure SDK documentation/examples, not as an autonomous runtime component. Before copying examples, use least-privilege Azure credentials, avoid uploading secrets or regulated data unless approved, treat include_credentials=True results as sensitive, and review any external tool or storage behavior for your organization’s privacy and retention requirements.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example uploads a local file to a remote Azure service without any warning that file contents leave the local environment. In a developer skill, this can lead to accidental disclosure of sensitive documents, credentials, proprietary data, or regulated content if users copy the pattern with real files.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation explicitly demonstrates retrieving connections with `include_credentials=True` but does not warn that this exposes sensitive secrets and should be tightly controlled. In an AI-agent/SDK context, examples are often copied directly into production or agent tooling, so normalizing credential retrieval without guidance can lead to accidental secret disclosure through logs, prompts, traces, or downstream tool calls.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The Bing grounding, OpenAPI, MCP, and similar web-connected tool examples show how to wire external-request capabilities into an agent but do not warn that prompts, query terms, or retrieved content may be sent to external services. In documentation for agent builders, this omission can lead developers to unknowingly route sensitive user input, internal prompts, or proprietary data to third-party endpoints, creating privacy, compliance, and data-governance risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The file upload and file search examples encourage uploading local files into remote agent/vector-store services without warning that the file contents leave the local environment. Developers may copy these patterns for sensitive documents, source code, or regulated datasets and unintentionally expose confidential information to hosted services or retention pipelines.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.