azure-validate

SAFE max severity MEDIUMSkillSpector Do not install 89 registry microsoft last scanned 2 scans

Verdict safe, but 5 findings (5 medium), mainly data exfiltration. Most recent scan 2026-10-22.

Findings5
Critical0
High0
Medium5
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictDo not install 89
Score89 / 100
Issues22
CategoriesPrivilege Escalation analysis-evasion Rogue Agent
Version2.12.0 (static)

The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis,…

Package
27 files, 90 KB
SKILL.md
370 words, 5 sections
Code
PowerShell (5), Shell (5)
License
MIT

SKILL.md covers: Azure Validate · Triggers · Rules · Steps · macOS/Linux: bash references/scripts/workflow.sh --workspace-path <workspace-path>

Findings

MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $RG_NAME (line 58) flows to `source` at line 80.

references/recipes/azd/scripts/set-aspire-aca-env.sh:80

echo "ERROR: Could not resolve $var_name ($description) in resource group '$RG_NAME'." >&2
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $RG_NAME (line 58) flows to `source` at line 89.

references/recipes/azd/scripts/set-aspire-aca-env.sh:89

echo "Resource group: $RG_NAME"
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $RG_NAME (line 58) flows to `source` at line 94.

references/recipes/azd/scripts/set-aspire-aca-env.sh:94

az acr list --resource-group "$RG_NAME" --query "[0].loginServer" -o tsv
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $RG_NAME (line 58) flows to `source` at line 99.

references/recipes/azd/scripts/set-aspire-aca-env.sh:99

az identity list --resource-group "$RG_NAME" --query "[0].id" -o tsv
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.
MEDIUM Bash: tainted data flows to dangerous sink Data Exfiltrationbehavioral

Variable $RG_NAME (line 58) flows to `source` at line 104.

references/recipes/azd/scripts/set-aspire-aca-env.sh:104

az identity list --resource-group "$RG_NAME" --query "[0].clientId" -o tsv
Remediation: Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.

What is in the package

27 files, 90 KB. Show the list.
FileKindSize
SKILL.mddoc3.5 KB
references/aspire-functions-secrets.mddoc3.7 KB
references/global-rules.mddoc1.2 KB
references/policy-validation.mddoc1.5 KB
references/region-availability.mddoc3.0 KB
references/role-verification.mddoc3.9 KB
references/recipes/README.mddoc374 B
references/scripts/scan-aspire-functions-secrets.ps1script3.0 KB
references/scripts/scan-aspire-functions-secrets.shscript3.3 KB
references/scripts/workflow.ps1script5.2 KB
references/scripts/workflow.shscript5.7 KB
references/recipes/azcli/README.mddoc2.7 KB
references/recipes/azcli/errors.mddoc505 B
references/recipes/azd/README.mddoc5.3 KB
references/recipes/azd/aspire.mddoc1.7 KB
references/recipes/azd/environment.mddoc1.9 KB
references/recipes/azd/errors.mddoc2.6 KB
references/recipes/bicep/README.mddoc2.5 KB
references/recipes/bicep/errors.mddoc374 B
references/recipes/scripts/validate-deployment.ps1script5.2 KB
references/recipes/scripts/validate-deployment.shscript6.0 KB
references/recipes/terraform/README.mddoc3.9 KB
references/recipes/terraform/errors.mddoc2.8 KB
references/recipes/azd/scripts/set-aspire-aca-env.ps1script3.5 KB
references/recipes/azd/scripts/set-aspire-aca-env.shscript3.6 KB
references/recipes/terraform/scripts/validate-terraform.ps1script6.8 KB
references/recipes/terraform/scripts/validate-terraform.shscript6.6 KB

External hosts referenced

developer.hashicorp.com azure.microsoft.com learn.microsoft.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

INFRA_DIR WORKSPACE_PATH AZURE_ENV_NAME AZURE_LOCATION AZURE_DIR AZURE_SUBSCRIPTION_ID SUBSCRIPTION_ID ACCOUNT_NAME ACCOUNT_OUT AZURE_CONTAINER_REGISTRY_ENDPOINT AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID MANAGED_IDENTITY_CLIENT_ID VALIDATE_STATUS_PATH

Package contents recorded 2026-10-22 at commit f49ac319a7d3. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Scan history

DateVerdictFindingsChangeAnalyzersRaw
SAFE 5 = static bytecode pipeline correlation behavioral trigger JSON
SAFE 5 first scan static bytecode pipeline correlation behavioral trigger JSON

Sources

Related skills