Azure Cosmos DB Python

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:20 AM UTC
• Version: 0.1.0

Overview

This Azure Cosmos DB skill is mostly purpose-aligned, but it needs review because it uses cloud database credentials and mutation tooling with weak endpoint scoping and broad activation terms.

Review before installing or running. Use a virtual environment, pin package versions, use least-privilege Azure credentials, verify COSMOS_ENDPOINT is exactly your intended Cosmos account endpoint, and test all create/delete/throughput examples only against non-production resources first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install azure-cosmos azure-identity ``` ### Technical Analysis The installation instructions specify `azure-cosmos` and `azure-identity` without exact versions or package hashes. Consequently, each installation can resolve to different package artifacts depending on the package index state at that time. Although the package names correspond to expected Azure libraries, the project does not provide a lock file, hash verification, or a trusted-index requirement. A compromised package release, package index, or dependency could therefore introduce code that was not included in this audit. Python packages may execute code during installation or when imported by the setup script. ### Attack Path 1. An attacker compromises a relevant package release, transitive dependency, or configured Python package index. 2. The attacker publishes a malicious or modified version under a version range accepted by the unpinned command. 3. A user follows the documented installation command. 4. `pip` resolves and downloads the attacker-controlled artifact. 5. Malicious code executes during installation or when the package is imported by `setup_cosmos_container.py`. ### Impact Assessment Malicious dependency code would generally execute with the privileges of the user running `pip` or the setup script. It could access environment variables such as `COSMOS_KEY` and `COSMOS_ENDPOINT`, steal Azure credentials available to `DefaultAzureCredential`, modify local files, or perform arbitrary network operations. If installation is performed by a privileged account, the impact could extend to system-wide compromise.
• Remediation: ## Remediation Suggestions - Pin every direct dependency to a reviewed exact version. - Maintain a lock file or hash-verified requirements file, for example using `--require-hashes`. - Pin and review transitive dependencies as well as direct dependencies. - Install packages only from an explicitly trusted package index. - Use automated dependency scanning and a controlled process for reviewing and updating pinned versions. - Run installation and the CLI under a dedicated, least-privileged virtual environment without unnecessary credentials.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_cosmos_container.py:30
• Finding: Unvalidated Cosmos Endpoint Can Receive Account Authentication Material## Vulnerability Details **File Location**: `scripts/setup_cosmos_container.py:30-39` **Vulnerability Type**: Untrusted endpoint configuration used with sensitive credentials **Risk Level**: High ### Vulnerable Code ```python def get_cosmos_client() -> CosmosClient: """Create Cosmos DB client from environment variables.""" endpoint = os.environ.get("COSMOS_ENDPOINT") if not endpoint: raise ValueError("COSMOS_ENDPOINT environment variable required") # Try key auth first, fall back to DefaultAzureCredential key = os.environ.get("COSMOS_KEY") if key: return CosmosClient(url=endpoint, credential=key) else: credential = DefaultAzureCredential() return CosmosClient(url=endpoint, credential=credential) ``` ### Technical Analysis `COSMOS_ENDPOINT` is treated as trusted after only checking that it is nonempty. The code does not enforce HTTPS, validate the hostname against an expected Azure Cosmos DB domain, or compare it with an administrator-approved account endpoint. When `COSMOS_KEY` is present, the unrestricted URL is passed to `CosmosClient` together with the account key. Subsequent database operations generate authenticated requests for that endpoint. An attacker who can influence the process environment can therefore redirect those requests to an attacker-controlled host and attempt to capture authorization data. The unrestricted endpoint can also cause the CLI to initiate outbound requests to unintended hosts. The fallback to `DefaultAzureCredential` reduces direct account-key exposure when no key is configured, but it does not make an attacker-controlled endpoint appropriate. Endpoint validation must occur independently of the selected authentication mechanism. ### Attack Path 1. An attacker gains the ability to modify `COSMOS_ENDPOINT`, such as through a manipulated shell environment, CI/CD variable, deployment configuration, or wrapper scr ...[truncated 1049 chars]
• Remediation: ## Remediation Suggestions - Parse the endpoint using a standard URL parser and require the `https` scheme. - Reject URLs containing user information, fragments, unexpected ports, or malformed hostnames. - Validate the hostname against the exact expected Cosmos account endpoint or an administrator-maintained allowlist. Avoid naive suffix checks that can accept look-alike domains. - Permit emulator, sovereign-cloud, or private endpoints only through explicit trusted configuration with separate validation rules. - Prefer `DefaultAzureCredential` with narrowly scoped Azure RBAC permissions instead of account-wide keys. - If account keys must be supported, use restricted resource tokens where possible and rotate any key suspected of exposure. - Protect CI/CD and deployment environment variables from modification by untrusted users. - Apply outbound network controls so the CLI can connect only to approved Azure endpoints.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill references environment variables and authentication material but does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can allow the skill to be invoked without clear limits on access to sensitive runtime context, increasing the chance of unintended credential or configuration use.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list contains broad generic terms like "container," "document," and "NoSQL," which could cause the skill to activate during unrelated database conversations. Unintended invocation is risky here because the skill includes authenticated database access patterns and write/delete examples, so accidental routing could lead to inappropriate operational guidance or actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill demonstrates live create, replace, upsert, throughput modification, and delete operations without prominent warnings that these examples mutate real databases. In an agent-assisted setting, users may run or adapt these snippets against production resources, causing accidental data loss, integrity issues, or unexpected cost increases.

Static analysis

No suspicious patterns detected.