ClawHub
Back to skill

Security audit

Azure Ai Projects - Microsoft Foundry SDKs

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Azure AI Projects SDK guidance skill, with legitimate but sensitive cloud, credential, upload, delete, and memory examples that users should apply carefully.

Install in a virtual environment, pin reviewed dependency versions, and ensure Azure credentials are scoped to the intended project. Treat examples using include_credentials, dataset credentials, file uploads, evaluations, SharePoint/Bing/MCP/REST tools, delete calls, and memory stores as production-sensitive patterns that need consent, data minimization, secret redaction, and confirmation around destructive operations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Azure SDK Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–15
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install azure-ai-projects azure-identity

The same unpinned installation pattern is also reflected in references/acceptance-criteria.md.

Technical Analysis

The installation command retrieves the latest compatible versions of azure-ai-projects, azure-identity, and their transitive dependencies from pip's configured package index. It does not specify reviewed versions, verify package hashes, or use a lockfile.

Although the package names are consistent with the declared Azure SDK functionality and no malicious package was identified in the project, the command creates a mutable supply-chain dependency. Future package releases, compromised upstream accounts, malicious transitive dependencies, or an untrusted configured package index could cause users to install code that was not reviewed with this Skill.

Python packages may execute code during installation or when subsequently imported. Consequently, compromise of the dependency-resolution path could lead to code execution with the privileges of the user running pip or the application importing the packages.

Attack Path

  1. A user or automated agent follows the documented installation command.
  2. pip contacts its configured package index and resolves the latest compatible direct and transitive dependencies.
  3. An upstream package release, transitive dependency, or configured index supplies a compromised artifact.
  4. Because no version or hash verification is required, pip accepts and installs that artifact.
  5. Malicious code executes during package installation or later when the application imports the affected package.

This attack requires compromise or manipulation of the package supply chain; the audited repository does not itself contain an embedded payload.

Impact Assessment

Successful exploitation co ...[truncated 467 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin direct dependencies to reviewed versions in a requirements or lock file.
  • Generate and verify cryptographic hashes for all direct and transitive packages.
  • Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
  • Configure pip to use an explicitly trusted package index.
  • Review and update locked dependencies through a controlled dependency-management process.
  • Run dependency vulnerability and provenance checks in CI before publishing updates.
  • Avoid installing packages with administrative privileges; use an isolated virtual environment.

Example hardened requirements entries should include approved versions and hashes:

text
azure-ai-projects==<reviewed-version> \
    --hash=sha256:<verified-package-hash>
azure-identity==<reviewed-version> \
    --hash=sha256:<verified-package-hash>

T08 · Insecure Dependencies

Warning
Location
references/async-patterns.md:7
Finding

Unpinned aiohttp Dependency

Content
View full analysis

Vulnerability Details

File Location: references/async-patterns.md, line 7
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

python
# Requires: pip install aiohttp

A duplicate recommendation also appears in references/acceptance-criteria.md near line 1192.

Technical Analysis

The asynchronous setup instructions recommend installing aiohttp without a fixed version, lockfile, integrity hash, or trusted-index requirement. This allows the effective installed artifact and its dependency graph to change independently of the reviewed Skill.

No malicious behavior was found in the instruction itself, and aiohttp is relevant to the documented asynchronous SDK patterns. Nevertheless, resolving a mutable package version creates exposure to upstream compromise, malicious transitive dependencies, or package-index manipulation.

Attack Path

  1. A user follows the asynchronous setup guidance and executes pip install aiohttp.
  2. pip resolves aiohttp and its transitive dependencies from the configured index.
  3. A compromised release, dependency, or index serves an unreviewed malicious artifact.
  4. The absence of version and hash constraints allows installation to proceed.
  5. Malicious code executes during installation or when the asynchronous application imports the affected package.

Impact Assessment

Exploitation could provide arbitrary code execution under the installing or application user account. The malicious dependency could access local files, process environment variables, Azure-related configuration, and network services available to that account.

No instruction to install as an administrator and no mechanism for privilege escalation or persistence was identified.

Remediation
View remediation

Remediation Suggestions

  • Add aiohttp to the project's version-controlled dependency or lock file at a reviewed version.
  • Lock all transitive dependencies and record verified artifact hashes.
  • Require installation from an explicitly trusted package index.
  • Use pip hash enforcement during reproducible installation.
  • Scan the resolved dependency graph for known vulnerabilities and unexpected package sources.
  • Perform installations in a least-privileged virtual environment.

Replace the open-ended instruction with a controlled installation workflow, for example:

bash
python -m pip install --require-hashes -r requirements.txt

The corresponding requirements file should contain the reviewed aiohttp version and verified hashes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 269)May include surrounding context.

agent = project_client.agents.create_agent( model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"], name="json-agent", instructions="Always respond in JSON format.", response_format={"type": "json_object"}, )

text

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/agents.md (reported line 76)May include surrounding context.

agent = project_client.agents.create_agent( model=os.environ["AZURE_AI_MODEL_DEPLOYMENT_NAME"], name="json-agent", instructions="Always respond in JSON format.", response_format={"type": "json_object"}, )

text

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The example explicitly instructs users to retrieve a connection with include_credentials=True and then comments to access credentials, which is credential-access behavior in documentation. Although it does not directly exfiltrate secrets, in this context it teaches a sensitive operation without any caution, increasing the risk of credential disclosure through downstream debugging, logging, or insecure storage.

Content

Scanner excerpt · references/connections.md (reported line 72)May include surrounding context.

include_credentials=True, ) print(f"Endpoint: {connection.endpoint_url}")

Access credentials based on connection type

text

### Get Default Connection

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents creation of a persistent memory store and attaching it to an agent, but it does not warn that user prompts, model outputs, or other conversation-derived data may be retained beyond the current session. In an SDK guidance file, this omission can lead developers to enable long-lived storage by default without considering consent, retention, data minimization, or handling of sensitive information, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file includes examples that delete agents as cleanup steps, but the surrounding documentation does not warn readers that these calls permanently remove remote resources. Under the markdown-file criteria, behaviors affecting user data or system integrity should be disclosed to the user.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 472)May include surrounding context.

md
thread_id=thread.id,
    agent_id=agent.id,
)
# Immediately accessing messages without checking status

# CORRECT - always check run status
if run.status == "completed":

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document shows retrieving connections with include_credentials=True and then using the returned object, but provides no warning that this may expose secrets in memory, logs, debugging output, or downstream code. In an agent skill context, examples are often copied directly, so documenting credential retrieval without guardrails can normalize unsafe secret-handling patterns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown presents delete operations for datasets and indexes as straightforward examples, but does not warn that these actions may be destructive or irreversible. This omission matters because the skill description should disclose behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says this skill is for the high-level Azure AI Projects SDK and explicitly says low-level agent operations should use the separate azure-ai-agents-python skill. However, this reference file demonstrates direct use of azure.ai.agents models such as CodeInterpreterTool and FileSearchTool within agent construction, which overlaps with the lower-level agent domain the manifest says belongs elsewhere.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest positions this skill as the high-level Foundry SDK and specifically instructs users to use another skill for low-level agent operations. This file extensively documents agent threads, messages, runs, streaming, file upload, and vector store management through project_client.agents, which semantically conflicts with that declared separation of responsibilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation demonstrates retrieving connection objects with include_credentials=True but provides no warning or guardrails about secret handling, logging, least-privilege use, or avoiding accidental exposure. In an SDK reference for project connections to external services, examples that normalize credential retrieval can lead users to unnecessarily fetch and mishandle secrets in application code.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 1401)May include surrounding context.

python
from azure.ai.projects.models import DatasetVersion

dataset = project_client.datasets.upload_file(
    name="my-dataset",
    version="1.0",
    file_path="./data/training_data.csv",

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 1500)May include surrounding context.

python
from azure.ai.projects.models import DatasetVersion

dataset = project_client.datasets.upload_file(
    name="my-dataset",
    version="1.0",
    file_path="./data/training_data.csv",

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 1507)May include surrounding context.

python
from azure.ai.projects.models import DatasetVersion

dataset = project_client.datasets.upload_file(
    name="my-dataset",
    version="1.0",
    file_path="./data/training_data.csv",

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 1709)May include surrounding context.

python
from azure.ai.projects.models import DatasetVersion

dataset = project_client.datasets.upload_file(
    name="my-dataset",
    version="1.0",
    file_path="./data/training_data.csv",

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/datasets-indexes.md (reported line 10)May include surrounding context.

python
from azure.ai.projects.models import DatasetVersion

dataset = project_client.datasets.upload_file(
    name="my-dataset",
    version="1.0",
    file_path="./data/training_data.csv",

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/datasets-indexes.md (reported line 159)May include surrounding context.

python
from azure.ai.projects.models import DatasetVersion

dataset = project_client.datasets.upload_file(
    name="my-dataset",
    version="1.0",
    file_path="./data/training_data.csv",

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/datasets-indexes.md (reported line 167)May include surrounding context.

python
from azure.ai.projects.models import DatasetVersion

dataset = project_client.datasets.upload_file(
    name="my-dataset",
    version="1.0",
    file_path="./data/training_data.csv",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown includes a dataset deletion example that performs an irreversible operation without any surrounding warning, confirmation step, or cautionary note. For markdown files, destructive behaviors that could affect user data should be disclosed so users understand the impact before copying the example.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The delete-index example demonstrates a destructive action but provides no warning that removing an index can affect search availability or associated workflows. In markdown documentation, examples that can impact system integrity or availability should include a clear caution for users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example configures evaluation criteria that map user queries and model responses into a remote Azure/OpenAI evaluation workflow, but the documentation does not warn that this content is transmitted to cloud evaluation services. In practice, users may include sensitive prompts, personal data, or proprietary outputs in eval datasets, so the omission can lead to unintended data disclosure or policy/compliance violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The full evaluation example shows creating and running an evaluation against agent queries/responses without disclosing that these records leave the local environment and are processed by cloud services. Because this is reference documentation for an SDK skill, readers may copy the pattern directly into production-like testing with real user data, increasing the risk of inadvertent sensitive-data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents behaviors that upload local files to remote services, search external/web resources, and connect to SharePoint, MCP servers, and REST APIs, but it does not include warnings about potential transmission of user or system data. Under the markdown-specific SQP-2 criteria, descriptions of these behaviors should disclose possible effects on user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/acceptance-criteria.md (reported line 923)May include surrounding context.

md
toolset=toolset,
)

# Process run - functions auto-execute
run = project_client.agents.runs.create_and_process(
    thread_id=thread.id,
    agent_id=agent.id,

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/tools.md (reported line 177)May include surrounding context.

md
toolset=toolset,
)

# Process run - functions auto-execute
run = project_client.agents.runs.create_and_process(
    thread_id=thread.id,
    agent_id=agent.id,

Static analysis

No suspicious patterns detected.