azure-upgrade

SAFE max severity MEDIUMSkillSpector Do not install 100 registry microsoft last scanned 2 scans

Verdict safe, but 3 findings (3 medium), mainly data exfiltration, unauthorized tool use. Most recent scan 2026-10-22.

Findings3
Critical0
High0
Medium3
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 100
Score100 / 100
Issues15
CategoriesPrompt Injection Excessive Agency analysis-evasion
Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Assess and upgrade Azure workloads between plans, tiers, or SKUs, or modernize Azure SDK dependencies in source code. WHEN: upgrade Consumption to Flex Consumption, upgrade Azure Functions plan, change hosting plan, function app SKU, migrate App Service to Container Apps, modernize legacy Azure Java SDKs (com.microsoft.azure to com.azure), migrate Azure Cache for Redis (ACR/ACRE) to Azure Managed Redis (AMR).

Package
50 files, 331 KB
SKILL.md
1007 words, 8 sections
Code
Python (1)
License
MIT
Compatibility
python3.10+

SKILL.md covers: Azure Upgrade · Triggers · Rules · Upgrade Scenarios · MCP Tools · Steps · References · Next

Findings

MEDIUM Undeclared network usage Unauthorized Tool Usestatic

Skill code uses network libraries but doesn't declare network requirement

SKILL.md

Remediation: Declare network usage in compatibility field or remove network calls
MEDIUM Outbound network request primitives that can transmit data externally Data Exfiltrationstatic

Pattern detected: urllib.request.urlopen(

references/languages/java/scripts/upgrade_bom.py:82

with urllib.request.urlopen(BOM_POM_URL, timeout=HTTP_TIMEOUT_SECONDS) as response:
Remediation: Ensure network operations are necessary and document allowed destinations
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $runFromPackage (line 2) flows to `curl` at line 4.

references/services/functions/consumption-to-flex/windows/automation/deployment-package.md:15

curl --fail --location --silent --show-error --output "$UPGRADE_DIR/source-package.zip" "$runFromPackage"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

What is in the package

50 files, 331 KB. Show the list.
FileKindSize
SKILL.mddoc8.7 KB
references/global-rules.mddoc4.5 KB
references/workflow-details.mddoc2.1 KB
references/languages/java/INSTRUCTION.mddoc11 KB
references/languages/java/README.mddoc3.0 KB
references/services/redis/redis-to-amr.mddoc7.5 KB
references/languages/java/bom-migration/bom-gradle-settings.mddoc6.7 KB
references/languages/java/bom-migration/bom-gradle-toml.mddoc2.7 KB
references/languages/java/bom-migration/bom-gradle.mddoc5.1 KB
references/languages/java/bom-migration/bom-maven.mddoc4.7 KB
references/languages/java/bom-migration/bom-migration.mddoc4.2 KB
references/languages/java/bom-migration/bom-validation.mddoc1.5 KB
references/languages/java/package-specific/com.microsoft.azure.eventprocessorhost.mddoc5.5 KB
references/languages/java/package-specific/com.microsoft.azure.management.mddoc9.5 KB
references/languages/java/rules/efficiency.mddoc265 B
references/languages/java/rules/execution-guidelines.mddoc1.0 KB
references/languages/java/rules/review-code-changes.mddoc541 B
references/languages/java/rules/troubleshooting.mddoc2.5 KB
references/languages/java/rules/upgrade-strategy.mddoc1.4 KB
references/languages/java/rules/upgrade-success-criteria.mddoc686 B
references/languages/java/scripts/upgrade_bom.pyscript20 KB
references/languages/java/templates/PLAN_TEMPLATE.mddoc9.4 KB
references/languages/java/templates/PROGRESS_TEMPLATE.mddoc9.1 KB
references/languages/java/templates/SUMMARY_TEMPLATE.mddoc8.6 KB
references/languages/java/workflow/phase-1-precheck.mddoc2.3 KB
references/languages/java/workflow/phase-2-plan.mddoc2.9 KB
references/languages/java/workflow/phase-3-execute.mddoc2.4 KB
references/languages/java/workflow/phase-4-summarize.mddoc1.1 KB
references/services/functions/consumption-to-flex/linux/assessment.mddoc4.6 KB
references/services/functions/consumption-to-flex/linux/automation.mddoc17 KB
references/services/functions/consumption-to-flex/linux/workflow.mddoc12 KB
references/services/functions/consumption-to-flex/windows/assessment.mddoc6.8 KB
references/services/functions/consumption-to-flex/windows/automation.mddoc4.1 KB
references/services/functions/consumption-to-flex/windows/dependency-scan.mddoc13 KB
references/services/functions/consumption-to-flex/windows/progress-tracking.mddoc5.2 KB
references/services/functions/consumption-to-flex/windows/workflow.mddoc28 KB
references/services/functions/consumption-to-flex/windows/automation/access-key-copy.mddoc2.5 KB
references/services/functions/consumption-to-flex/windows/automation/access-key-strategy.mddoc2.1 KB
references/services/functions/consumption-to-flex/windows/automation/app-creation.mddoc17 KB
references/services/functions/consumption-to-flex/windows/automation/app-settings.mddoc12 KB
references/services/functions/consumption-to-flex/windows/automation/built-in-authentication.mddoc3.3 KB
references/services/functions/consumption-to-flex/windows/automation/cleanup-and-rollback.mddoc3.2 KB
references/services/functions/consumption-to-flex/windows/automation/code-deployment.mddoc8.6 KB
references/services/functions/consumption-to-flex/windows/automation/configuration-inventory.mddoc7.2 KB
references/services/functions/consumption-to-flex/windows/automation/deployment-package.mddoc6.0 KB
references/services/functions/consumption-to-flex/windows/automation/discovery-and-assessment.mddoc9.1 KB
references/services/functions/consumption-to-flex/windows/automation/networking-and-storage.mddoc3.9 KB
references/services/functions/consumption-to-flex/windows/automation/site-and-identity.mddoc5.0 KB
references/services/functions/consumption-to-flex/windows/automation/trigger-safety-and-monitoring.mddoc12 KB
references/services/functions/consumption-to-flex/windows/automation/validation-and-cutover.mddoc9.7 KB

External hosts referenced

learn.microsoft.com github.com raw.githubusercontent.com aka.ms docs.openrewrite.org repo1.maven.org maven.apache.org management.azure.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

TARGET_AZURE_SDK_BOM_VERSION UPGRADE_DIR AZURE_AUTH_LOCATION AZURE_CLIENT_ID AZURE_STORAGE_CONNECTION_STRING AZURE_UPGRADE_DIR DEFAULT_HOST SCM_DO_BUILD_DURING_DEPLOYMENT APPLICATIONINSIGHTS_AUTHENTICATION_STRING AZURE_CLIENT_SECRET AZURE_SUBSCRIPTION_ID AZURE_TENANT_ID JAVA_HOME JDK_HOME M2_HOME MAVEN_HOME

Package contents recorded 2026-10-22 at commit f49ac319a7d3. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Scan history

DateVerdictFindingsChangeAnalyzersRaw
SAFE 3 = static bytecode pipeline correlation behavioral trigger JSON
SAFE 3 first scan static bytecode pipeline correlation behavioral trigger JSON

Sources

Related skills