azure-ai-document-intelligence-dotnet
Verdict safe, but 2 findings (1 medium, 1 low), mainly data exfiltration, social engineering. Most recent scan 2026-02-05.
The azure-ai-document-intelligence-dotnet skill is a documentation-focused skill providing guidance for using Azure's Document Intelligence .NET SDK. The skill does not contain executable scripts, which significantly reduces its attack surface. However, it has MEDIUM severity security concerns related to credential management practices. The skill instructs users to store sensitive API keys and SAS tokens in environment variables without adequate security guidance, which could lead to credential exposure if users follow the examples in insecure environments. The skill also contains a misleading reference to a non-existent Python file and lacks optional metadata fields. Overall, the skill is relatively safe as it contains no executable code, but the credential handling guidance needs improvement to prevent users from inadvertently exposing sensitive credentials.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Azure AI Document Intelligence SDK for .NET. Extract text, tables, and structured data from documents using prebuilt and custom models. Use for invoice processing, receipt extraction, ID document analysis, and custom document models. Triggers: "Document Intelligence", "DocumentIntelligenceClient", "form recognizer", "invoice extraction", "receipt OCR", "document analysis .NET".
- Package
- 2 files, 25 KB
- SKILL.md
- 966 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Azure.AI.DocumentIntelligence (.NET) · Installation · Environment Variables · Authentication · Microsoft Entra ID (Recommended) · API Key · Client Types · Prebuilt Models · Core Workflows · 1. Analyze Invoice · 2. Extract Layout (Text, Tables, Structure) · 3. Analyze Receipt
Findings
MEDIUM Hardcoded Credentials in Environment Variables Without Secure Storage Guidance Data Exfiltrationllm
The skill instructs users to store sensitive credentials (DOCUMENT_INTELLIGENCE_API_KEY) in environment variables without providing guidance on secure storage mechanisms. While environment variables are mentioned, there is no warning about the risks of exposing API keys or recommendations for using secure credential management systems (e.g., Azure Key Vault, .NET Secret Manager). This could lead users to hardcode credentials in configuration files or expose them in version control systems.
SKILL.md
```bash
DOCUMENT_INTELLIGENCE_ENDPOINT=https://<resource-name>.cognitiveservices.azure.com/
DOCUMENT_INTELLIGENCE_API_KEY=<your-api-key>
BLOB_CONTAINER_SAS_URL=https://<storage>.blob.core.windows.net/<container>?<sas-token>
```LOW Missing Referenced File Creates Incomplete Documentation Social Engineeringllm
The skill instructions reference a file 'documents.py' that is not included in the skill package. This creates misleading documentation as users may expect Python examples or helper code that doesn't exist. The skill is described as a .NET SDK skill, making the Python file reference particularly confusing and potentially indicating incomplete or incorrect documentation.
Referenced file 'documents.py' not found in skill package. Skill is for .NET (C#) but references Python file.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 11 KB |
references/acceptance-criteria.md | doc | 15 KB |
External hosts referenced
github.com storage.blob.core.windows.net www.nuget.org aka.ms documentintelligence.ai.azure.com learn.microsoft.com my-resource.cognitiveservices.azure.com storageaccount.blob.core.windows.net
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit cfbcbbdc679c. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/microsoft/agent-skills
- Raw scan result: github-skills-azure-ai-document-intelligence-dotnet-scan.json
- Badge for your README:
- Request a re-scan