azure-containerregistry-py
Verdict safe, but 1 finding (1 medium), mainly command injection. Most recent scan 2026-02-05.
This skill is a documentation/tutorial package for the Azure Container Registry Python SDK with LOW to MEDIUM security risk. The primary concern is the unpinned package dependency which could introduce supply chain vulnerabilities. The skill contains no executable scripts, no data exfiltration attempts, no prompt injection, and no malicious code. It's essentially a reference guide showing legitimate Azure SDK usage patterns. The missing optional metadata fields reduce transparency but don't constitute a security threat. The skill appropriately uses Azure's recommended authentication patterns (DefaultAzureCredential). The referenced Python files (ArtifactTagOrder.py, etc.) are standard Azure SDK imports, not bundled files, so their absence is expected and not a security concern.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Azure Container Registry SDK for Python. Use for managing container images, artifacts, and repositories. Triggers: "azure-containerregistry", "ContainerRegistryClient", "container images", "docker registry", "ACR".
- Package
- 2 files, 22 KB
- SKILL.md
- 524 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Azure Container Registry SDK for Python · Installation · Environment Variables · Authentication · Entra ID (Recommended) · Anonymous Access (Public Registry) · List Repositories · Repository Operations · Get Repository Properties · Update Repository Properties · Delete Repository · List Tags
Findings
MEDIUM Unpinned Package Dependency Installation Command Injectionllm
The skill instructs installation of 'azure-containerregistry' package without version pinning (pip install azure-containerregistry). This creates a supply chain risk where future malicious or breaking versions could be automatically installed, potentially introducing vulnerabilities or unexpected behavior changes.
SKILL.md:7
```bash
pip install azure-containerregistry
```What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 6.0 KB |
references/acceptance-criteria.md | doc | 16 KB |
External hosts referenced
mcr.microsoft.com github.com myregistry.azurecr.io
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit cfbcbbdc679c. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/microsoft/agent-skills
- Raw scan result: github-skills-azure-containerregistry-py-scan.json
- Badge for your README:
- Request a re-scan