azure-cloud-migrate

SAFE max severity MEDIUMSkillSpector Do not install 95 registry microsoft last scanned 2 scans

Verdict safe, but 8 findings (8 medium), mainly data exfiltration. Most recent scan 2026-10-22.

Findings8
Critical0
High0
Medium8
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 95
Score95 / 100
Issues11
CategoriesMCP Rug Pull analysis-evasion Privilege Escalation
Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda→Functions, Beanstalk/Heroku/App Engine→App Service, Fargate/Kubernetes/Cloud Run/Spring Boot→Container Apps. WHEN: migrate Lambda to Functions, AWS to Azure, migrate Beanstalk, migrate Heroku, migrate App Engine, Cloud Run migration, Fargate to ACA, ECS/Kubernetes/GKE/EKS to Container Apps, Spring Boot to Container Apps, cross-cloud migration.

Package
31 files, 178 KB
SKILL.md
351 words, 5 sections
Code
None. Instructions only.
License
MIT

SKILL.md covers: Azure Cloud Migrate · Rules · Migration Scenarios · Output Directory · Steps

Findings

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SUBNET_ID (line 4) flows to `source` at line 7.

references/services/container-apps/cloudrun-deployment-guide.md:82

--infrastructure-subnet-resource-id "$SUBNET_ID"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $FQDN (line 1) flows to `curl` at line 2.

references/services/container-apps/cloudrun-deployment-guide.md:194

curl -I "https://$FQDN/health"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $LOG_ID (line 3) flows to `source` at line 5.

references/services/container-apps/deployment-guide.md:65

az containerapp env create --name myapp-env --resource-group myapp-rg --location eastus --logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $FQDN (line 2) flows to `curl` at line 4.

references/services/container-apps/deployment-guide.md:160

curl https://$FQDN/health
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $SUBNET_ID (line 7) flows to `source` at line 10.

references/services/container-apps/fargate-deployment-guide.md:75

--infrastructure-subnet-resource-id "$SUBNET_ID"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $FQDN (line 2) flows to `curl` at line 3.

references/services/container-apps/fargate-deployment-guide.md:199

curl -f -I "https://$FQDN/health" || { echo "Health check failed"; exit 1; }
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $LOG_ID (line 5) flows to `source` at line 7.

references/services/container-apps/spring-deployment-guide.md:13

az containerapp env create --name spring-env --resource-group spring-rg --location eastus --logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $FQDN (line 1) flows to `curl` at line 3.

references/services/container-apps/spring-deployment-guide.md:238

curl "https://${FQDN}/actuator/health"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

What is in the package

31 files, 178 KB. Show the list.
FileKindSize
SKILL.mddoc4.3 KB
references/workflow-details.mddoc2.3 KB
references/services/app-service/app-engine-to-app-service.mddoc7.1 KB
references/services/app-service/assessment.mddoc5.2 KB
references/services/app-service/beanstalk-to-app-service.mddoc6.4 KB
references/services/app-service/code-migration.mddoc5.0 KB
references/services/app-service/global-rules.mddoc2.8 KB
references/services/app-service/heroku-to-app-service.mddoc7.5 KB
references/services/container-apps/assessment-guide.mddoc7.0 KB
references/services/container-apps/cloudrun-assessment-guide.mddoc2.5 KB
references/services/container-apps/cloudrun-deployment-guide.mddoc7.9 KB
references/services/container-apps/cloudrun-to-container-apps.mddoc2.2 KB
references/services/container-apps/deployment-guide.mddoc9.6 KB
references/services/container-apps/fargate-assessment-guide.mddoc2.4 KB
references/services/container-apps/fargate-deployment-guide.mddoc10 KB
references/services/container-apps/fargate-to-container-apps.mddoc4.0 KB
references/services/container-apps/k8s-to-container-apps.mddoc4.9 KB
references/services/container-apps/spring-apps-to-aca.mddoc3.8 KB
references/services/container-apps/spring-assessment-guide.mddoc5.2 KB
references/services/container-apps/spring-dependency-patterns.mddoc1.2 KB
references/services/container-apps/spring-deployment-guide.mddoc15 KB
references/services/functions/assessment.mddoc6.3 KB
references/services/functions/code-migration.mddoc6.0 KB
references/services/functions/global-rules.mddoc3.3 KB
references/services/functions/lambda-to-functions.mddoc10 KB
references/services/functions/runtimes/csharp.mddoc5.5 KB
references/services/functions/runtimes/java.mddoc6.4 KB
references/services/functions/runtimes/javascript.mddoc8.5 KB
references/services/functions/runtimes/powershell.mddoc5.0 KB
references/services/functions/runtimes/python.mddoc6.4 KB
references/services/functions/runtimes/typescript.mddoc3.5 KB

External hosts referenced

learn.microsoft.com github.com aka.ms ossrdbms-aad.database.windows.net spring.io

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

KEY_VAULT IDENTITY_ID PRINCIPAL_ID LOG_ID ACR_ID STORAGE_ACCOUNT AZURE_CLIENT_ID LOG_KEY GCP_PROJECT GCP_REGION SECRET_FILE SECRET_URI KV_ID STORAGE_KEY AWS_REGION OUTPUT_DIR AWS_ACCOUNT_ID DATABASE_URL SUBNET_ID API_KEY APPLICATIONINSIGHTS_AUTHENTICATION_STRING COMPUTER_VISION_ENDPOINT DB_PASSWORD GOOGLE_CLOUD_PROJECT ORDER_SERVICE_URL PGDATABASE PGHOST PORT REDIS_URL SECRET_KEY

Package contents recorded 2026-10-22 at commit f49ac319a7d3. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Scan history

DateVerdictFindingsChangeAnalyzersRaw
SAFE 8 = static bytecode pipeline correlation behavioral trigger JSON
SAFE 8 first scan static bytecode pipeline correlation behavioral trigger JSON

Sources

Related skills