Azure Cosmos DB Python

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:20 AM UTC
• Version: 0.1.0

Overview

This Azure Cosmos DB skill is mostly purpose-aligned, but it needs review because it uses cloud database credentials and mutation tooling with weak endpoint scoping and broad activation terms.

Review before installing or running. Use a virtual environment, pin package versions, use least-privilege Azure credentials, verify COSMOS_ENDPOINT is exactly your intended Cosmos account endpoint, and test all create/delete/throughput examples only against non-production resources first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

pip install azure-cosmos azure-identity

Technical Analysis

The installation instructions specify azure-cosmos and azure-identity without exact versions or package hashes. Consequently, each installation can resolve to different package artifacts depending on the package index state at that time.

Although the package names correspond to expected Azure libraries, the project does not provide a lock file, hash verification, or a trusted-index requirement. A compromised package release, package index, or dependency could therefore introduce code that was not included in this audit. Python packages may execute code during installation or when imported by the setup script.

Attack Path

1. An attacker compromises a relevant package release, transitive dependency, or configured Python package index.
2. The attacker publishes a malicious or modified version under a version range accepted by the unpinned command.
3. A user follows the documented installation command.
4. pip resolves and downloads the attacker-controlled artifact.
5. Malicious code executes during installation or when the package is imported by setup_cosmos_container.py.

Impact Assessment

Malicious dependency code would generally execute with the privileges of the user running pip or the setup script. It could access environment variables such as COSMOS_KEY and COSMOS_ENDPOINT, steal Azure credentials available to DefaultAzureCredential, modify local files, or perform arbitrary network operations. If installation is performed by a privileged account, the impact could extend to system-wide compromise.

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed exact version.
• Maintain a lock file or hash-verified requirements file, for example using --require-hashes.
• Pin and review transitive dependencies as well as direct dependencies.
• Install packages only from an explicitly trusted package index.
• Use automated dependency scanning and a controlled process for reviewing and updating pinned versions.
• Run installation and the CLI under a dedicated, least-privileged virtual environment without unnecessary credentials.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_cosmos_container.py:30

Finding

Unvalidated Cosmos Endpoint Can Receive Account Authentication Material

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_cosmos_container.py:30-39
Vulnerability Type: Untrusted endpoint configuration used with sensitive credentials
Risk Level: High

Vulnerable Code

python

def get_cosmos_client() -> CosmosClient:
    """Create Cosmos DB client from environment variables."""
    endpoint = os.environ.get("COSMOS_ENDPOINT")
    if not endpoint:
        raise ValueError("COSMOS_ENDPOINT environment variable required")
    
    # Try key auth first, fall back to DefaultAzureCredential
    key = os.environ.get("COSMOS_KEY")
    if key:
        return CosmosClient(url=endpoint, credential=key)
    else:
        credential = DefaultAzureCredential()
        return CosmosClient(url=endpoint, credential=credential)

Technical Analysis

COSMOS_ENDPOINT is treated as trusted after only checking that it is nonempty. The code does not enforce HTTPS, validate the hostname against an expected Azure Cosmos DB domain, or compare it with an administrator-approved account endpoint.

When COSMOS_KEY is present, the unrestricted URL is passed to CosmosClient together with the account key. Subsequent database operations generate authenticated requests for that endpoint. An attacker who can influence the process environment can therefore redirect those requests to an attacker-controlled host and attempt to capture authorization data. The unrestricted endpoint can also cause the CLI to initiate outbound requests to unintended hosts.

The fallback to DefaultAzureCredential reduces direct account-key exposure when no key is configured, but it does not make an attacker-controlled endpoint appropriate. Endpoint validation must occur independently of the selected authentication mechanism.

Attack Path

1. An attacker gains the ability to modify COSMOS_ENDPOINT, such as through a manipulated shell environment, CI/CD variable, deployment configuration, or wrapper scr ...[truncated 1049 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the endpoint using a standard URL parser and require the https scheme.
• Reject URLs containing user information, fragments, unexpected ports, or malformed hostnames.
• Validate the hostname against the exact expected Cosmos account endpoint or an administrator-maintained allowlist. Avoid naive suffix checks that can accept look-alike domains.
• Permit emulator, sovereign-cloud, or private endpoints only through explicit trusted configuration with separate validation rules.
• Prefer DefaultAzureCredential with narrowly scoped Azure RBAC permissions instead of account-wide keys.
• If account keys must be supported, use restricted resource tokens where possible and rotate any key suspected of exposure.
• Protect CI/CD and deployment environment variables from modification by untrusted users.
• Apply outbound network controls so the CLI can connect only to approved Azure endpoints.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill references environment variables and authentication material but does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow the skill to be invoked without clear limits on access to sensitive runtime context, increasing the chance of unintended credential or configuration use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list contains broad generic terms like "container," "document," and "NoSQL," which could cause the skill to activate during unrelated database conversations. Unintended invocation is risky here because the skill includes authenticated database access patterns and write/delete examples, so accidental routing could lead to inappropriate operational guidance or actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill demonstrates live create, replace, upsert, throughput modification, and delete operations without prominent warnings that these examples mutate real databases. In an agent-assisted setting, users may run or adapt these snippets against production resources, causing accidental data loss, integrity issues, or unexpected cost increases.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.