azure-app-onboard

ISSUES FOUND max severity CRITICALSkillSpector Do not install 100 registry microsoft last scanned 2 scans

1 finding (1 critical), mainly command injection. Most recent scan 2026-10-22.

Findings1
Critical1
High0
Medium0
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 100
Score100 / 100
Issues23
CategoriesExcessive Agency analysis-evasion Privilege Escalation
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

End-to-end orchestrator: from a business idea, app idea, or existing app to running Azure deployment with cost estimates and pre-deploy approval. Analyzes your app, auto-detects the right Azure services, scaffolds infrastructure code, and deploys — tailored to your app, not a template. Handles moving existing apps to Azure without rewriting or with minimal changes. WHEN: bring your app to Azure, plan my app, cost to run, is my code ready to deploy, deploy my app to the cloud, deploy all my services, what Azure services do I need, plan my Azure deployment, deploy my new app to Azure,…

Package
68 files, 373 KB
SKILL.md
797 words, 7 sections
Code
TypeScript (4), PowerShell (1), Shell (1)
License
MIT

SKILL.md covers: Azure App Onboard · Quick Reference · When to Use This Skill · When NOT to Use · Pipeline Rules · Workflow · Error Handling

Findings

CRITICAL Discovery and execution chain (find -exec) Command Injectionpipeline

The find command with -exec executes commands on discovered files. An attacker can use this to find and execute hidden malicious scripts.

scaffold/scripts/scaffold-conformance.sh:21

#!/usr/bin/env bash
# Scaffold -> Deploy conformance gate (bash twin of scaffold-conformance.ps1).
# Checks generated IaC against the plan for semantic defects `az bicep build` cannot catch.
#
# Usage:  scaffold-conformance.sh <sessionPath> [infraPath]
# Output: JSON { passed, failures:[{id,detail,f
Remediation: Review the command sequence for potential multi-step attacks. Ensure all steps are necessary and safe.

What is in the package

68 files, 373 KB. Show the list.
FileKindSize
SKILL.mddoc6.6 KB
deploy/SKILL.mddoc7.5 KB
prepare/SKILL.mddoc6.4 KB
references/approval-gates.mddoc7.4 KB
references/azd-template-routing.mddoc4.7 KB
references/handoff-protocol.mddoc7.8 KB
references/iac-resources.mddoc2.6 KB
references/intent-gathering.mddoc2.2 KB
references/mcp-tool-reference.mddoc3.7 KB
references/pipeline-rules-runtime.mddoc3.5 KB
references/pipeline-rules.mddoc6.3 KB
references/session-protocol.mddoc8.0 KB
references/session-schemas.tsscript5.2 KB
references/subscription-resolution.mddoc2.1 KB
scaffold/SKILL.mddoc14 KB
deploy/references/approval-gate-template.mddoc2.9 KB
deploy/references/blocked-patterns.mddoc5.7 KB
deploy/references/code-deployment-appservice.mddoc4.6 KB
deploy/references/code-deployment-container-apps.mddoc8.4 KB
deploy/references/code-deployment-swa.mddoc5.7 KB
deploy/references/database-post-deploy.mddoc4.5 KB
deploy/references/deploy-checklist-template.mddoc10 KB
deploy/references/deploy-safety.mddoc4.5 KB
deploy/references/deploy-schemas.tsscript3.5 KB
deploy/references/error-classification.mddoc3.6 KB
deploy/references/health-check-patterns.mddoc5.5 KB
deploy/references/mcp-tools.mddoc5.5 KB
deploy/references/portal-links.mddoc3.1 KB
deploy/references/preflight-checks.mddoc4.4 KB
deploy/references/subagent-preflight.mddoc5.1 KB
prepare/references/deploy-strategy.mddoc6.8 KB
prepare/references/mcp-tools.mddoc5.6 KB
prepare/references/naming-patterns.mddoc4.6 KB
prepare/references/prepare-schemas.tsscript7.0 KB
prepare/references/pricing-guide-services.mddoc8.4 KB
prepare/references/pricing-guide.mddoc4.0 KB
prepare/references/service-mapping.mddoc8.5 KB
prepare/references/sku-matrix.mddoc3.2 KB
prepare/references/sku-quota-validation.mddoc9.0 KB
prepare/references/subagent-pricing.mddoc2.5 KB
prepare/references/subagent-quota.mddoc3.5 KB
prepare/references/validation-rubric.mddoc2.3 KB
scaffold/references/bicep-app-service.mddoc5.2 KB
scaffold/references/bicep-container-apps.mddoc9.3 KB
scaffold/references/bicep-patterns-data.mddoc4.0 KB
scaffold/references/bicep-patterns-security.mddoc7.8 KB
scaffold/references/bicep-patterns.mddoc6.8 KB
scaffold/references/bicep-swa.mddoc757 B
scaffold/references/cicd-pipelines.mddoc325 B
scaffold/references/dockerfile-generation.mddoc3.8 KB
scaffold/references/env-var-secrets.mddoc4.1 KB
scaffold/references/error-handling.mddoc1.5 KB
scaffold/references/iac-generation-rules.mddoc6.6 KB
scaffold/references/mcp-tools.mddoc7.0 KB
scaffold/references/rbac-roles.mddoc3.8 KB
scaffold/references/scaffold-healing-rules.mddoc3.3 KB
scaffold/references/scaffold-schemas.tsscript3.5 KB
scaffold/references/self-healing.mddoc2.3 KB
scaffold/references/self-review-checklist.mddoc9.0 KB
scaffold/references/self-review-procedure.mddoc2.3 KB
scaffold/references/subagent-iac-gen.mddoc9.5 KB
scaffold/references/subagent-review.mddoc3.5 KB
scaffold/references/subagent-validate.mddoc7.2 KB
scaffold/references/terraform-patterns.mddoc6.9 KB
scaffold/references/validation-and-manifest.mddoc5.1 KB
scaffold/references/waf-checklist.mddoc2.3 KB
scaffold/scripts/scaffold-conformance.ps1script13 KB
scaffold/scripts/scaffold-conformance.shscript14 KB

External hosts referenced

learn.microsoft.com portal.azure.com management.azure.com prices.azure.com registry.terraform.io azure.microsoft.com graph.microsoft.com myapp-ca-dev-a1b2.azurecontainerapps.io schema.management.azure.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

INFRA_PATH SECRET_KEY SESSION_PATH API_KEY ARM_CLIENT_ID ARM_CLIENT_SECRET ARM_TENANT_ID AZURE_SUBSCRIPTION_ID AZURE_TENANT_ID DATABASE_URL JWT_SECRET MYSQLDB_DATABASE NEXT_PUBLIC_API_URL POSTGRES_PASSWORD REACT_APP_API_URL SWA_CLI_DEPLOYMENT_TOKEN VITE_API_BASE_URL

Package contents recorded 2026-10-22 at commit f49ac319a7d3. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Scan history

DateVerdictFindingsChangeAnalyzersRaw
CRITICAL 1 = static bytecode pipeline correlation behavioral trigger JSON
CRITICAL 1 first scan static bytecode pipeline correlation behavioral trigger JSON

Sources

Related skills