{"data":{"skill":{"slug":"microsoft-appinsights-instrumentation","name":"appinsights-instrumentation","icon":"📦","repo":"https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/appinsights-instrumentation/","status":"approved","author":"microsoft","authorVersion":"0.0.0-placeholder","skillstoreRevision":2},"audit":{"id":"2c7f2d59-1bab-4401-a29e-ac5cde450448","skill_id":"3528921c-1f09-454f-8dcb-4c940ec22cbc","version":5,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:9b9b19b1a8e826a18820c83027d528e4f75e27b444cde67cea6baab0f7aebc7c:b7ce7b8b75391515f687a15dda4893dc1386c873a9639f4e58c5284ea69ba71c:736b696c6c732f6d6963726f736f66742f617070696e7369676874732d696e737472756d656e746174696f6e:607a1e0d48a93b10579b61979d9f2f37","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The reviewed patterns are documentation and examples for Azure Application Insights. Relative links, Azure CLI substitutions, portal URLs, and environment reads do not demonstrate traversal, reconnaissance, or unauthorized secret access. No prompt injection or malicious intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"references/aspnetcore.md","line_end":19,"line_start":19},{"file":"references/aspnetcore.md","line_end":27,"line_start":27}]},{"factor":"network","evidence":[{"file":"references/auto.md","line_end":10,"line_start":10},{"file":"references/container-apps.md","line_end":81,"line_start":81}]},{"factor":"external_commands","evidence":[{"file":"references/container-apps.md","line_end":12,"line_start":10},{"file":"references/container-apps.md","line_end":16,"line_start":14}]},{"factor":"env_access","evidence":[{"file":"references/nodejs.md","line_end":15,"line_start":15},{"file":"references/sdk/azure-monitor-opentelemetry-ts.md","line_end":15,"line_start":15},{"file":"references/sdk/azure-monitor-opentelemetry-ts.md","line_end":15,"line_start":15}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":14,"total_lines":570,"audit_model":"codex","audited_at":"2026-07-23T17:41:02.651+00:00","created_at":"2026-07-25T23:04:38.984502+00:00","static_findings":[{"id":"blocker:examples/appinsights.bicep:26:system-reconnaissance","file":"examples/appinsights.bicep","pattern":"System reconnaissance","snippet":"WorkspaceResourceId: logAnalyticsWorkspace.id","category":"blocker","line_end":27,"severity":"low","line_start":26},{"id":"filesystem:references/aspnetcore.md:19:path-traversal-sequence","file":"references/aspnetcore.md","pattern":"Path traversal sequence","snippet":"The App Insights resource has a connection string. Add the connection string as an environment varia","category":"filesystem","line_end":19,"severity":"high","line_start":19},{"id":"filesystem:references/aspnetcore.md:27:path-traversal-sequence","file":"references/aspnetcore.md","pattern":"Path traversal sequence","snippet":"If the app has IaC template such as Bicep or terraform files representing its cloud instance, this e","category":"filesystem","line_end":27,"severity":"high","line_start":27},{"id":"network:references/auto.md:10:hardcoded-url","file":"references/auto.md","pattern":"Hardcoded URL","snippet":"https://portal.azure.com/#resource/subscriptions/{subscription_id}/resourceGroups/{resource_group_na","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"external_commands:references/container-apps.md:10:shell-command-substitution","file":"references/container-apps.md","pattern":"Shell command substitution","snippet":"WORKSPACE_ID=$(az monitor log-analytics workspace show \\","category":"external_commands","line_end":12,"severity":"medium","line_start":10},{"id":"external_commands:references/container-apps.md:14:shell-command-substitution","file":"references/container-apps.md","pattern":"Shell command substitution","snippet":"WORKSPACE_KEY=$(az monitor log-analytics workspace get-shared-keys \\","category":"external_commands","line_end":16,"severity":"medium","line_start":14},{"id":"network:references/container-apps.md:81:http-client-library","file":"references/container-apps.md","pattern":"HTTP client library","snippet":"2. HTTP clients use instrumented libraries (e.g., `requests` in Python, `fetch`/`axios` in Node.js)","category":"network","line_end":81,"severity":"low","line_start":81},{"id":"sensitive:references/container-apps.md:123:environment-file-access","file":"references/container-apps.md","pattern":"Environment file access","snippet":"| mv-expand envVar = container.env","category":"sensitive","line_end":123,"severity":"high","line_start":123},{"id":"blocker:references/container-apps.md:21:system-reconnaissance","file":"references/container-apps.md","pattern":"System reconnaissance","snippet":"--logs-workspace-id $WORKSPACE_ID \\","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"env_access:references/nodejs.md:15:dotenv-library","file":"references/nodejs.md","pattern":"dotenv library","snippet":"> Note: The setup method should be called as early as possible but it must be after the environment ","category":"env_access","line_end":15,"severity":"low","line_start":15},{"id":"env_access:references/sdk/azure-monitor-opentelemetry-ts.md:15:environment-variable-access-dot-notation","file":"references/sdk/azure-monitor-opentelemetry-ts.md","pattern":"Environment variable access (dot notation)","snippet":"connectionString: process.env.APPLICATIONINSIGHTS_CONNECTION_STRING","category":"env_access","line_end":15,"severity":"low","line_start":15},{"id":"env_access:references/sdk/azure-monitor-opentelemetry-ts.md:15:environment-variable-object","file":"references/sdk/azure-monitor-opentelemetry-ts.md","pattern":"Environment variable object","snippet":"connectionString: process.env.APPLICATIONINSIGHTS_CONNECTION_STRING","category":"env_access","line_end":15,"severity":"low","line_start":15},{"id":"sensitive:references/sdk/azure-monitor-opentelemetry-ts.md:15:environment-file-access","file":"references/sdk/azure-monitor-opentelemetry-ts.md","pattern":"Environment file access","snippet":"connectionString: process.env.APPLICATIONINSIGHTS_CONNECTION_STRING","category":"sensitive","line_end":15,"severity":"high","line_start":15}],"finding_verdicts":[{"id":"blocker:examples/appinsights.bicep:26:system-reconnaissance","reason":"The line assigns the Bicep workspace resource ID to an Application Insights property. It does not enumerate or inspect host system information.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/aspnetcore.md:19:path-traversal-sequence","reason":"The sequence appears in a Markdown link to the bundled scripts/appinsights.ps1 reference. It performs no runtime path resolution or user-controlled file access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/aspnetcore.md:27:path-traversal-sequence","reason":"The sequence is another relative Markdown link to the same bundled script. It is documentation navigation, not a filesystem traversal operation.","verdict":"false_positive","confidence":0.99},{"id":"network:references/auto.md:10:hardcoded-url","reason":"This is a templated URL for the official Azure Portal domain. It contains resource placeholders and does not transmit data to an untrusted endpoint.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/container-apps.md:10:shell-command-substitution","reason":"The substitution captures a workspace customer ID from a fixed Azure CLI query. It does not evaluate generated code or interpolate an executable command.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:references/container-apps.md:14:shell-command-substitution","reason":"The substitution captures a workspace key from a fixed Azure CLI command for later configuration. The documented placeholders are command arguments, not arbitrary shell input.","verdict":"false_positive","confidence":0.95},{"id":"network:references/container-apps.md:81:http-client-library","reason":"The line only names common HTTP libraries that support trace propagation. It contains no network request, destination, or data transfer.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/container-apps.md:123:environment-file-access","reason":"This is a KQL mv-expand operation over Azure resource configuration metadata. The query checks environment variable names and does not read an environment file or secret values.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/container-apps.md:21:system-reconnaissance","reason":"The argument supplies a previously selected Log Analytics workspace ID to Azure Container Apps. It does not discover host or network information.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/nodejs.md:15:dotenv-library","reason":"The line mentions dotenv only to explain initialization order. It neither loads an environment file nor exposes environment values.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/sdk/azure-monitor-opentelemetry-ts.md:15:environment-variable-access-dot-notation","reason":"The example reads the documented Application Insights connection variable for SDK configuration. It does not log the value or send it to an unauthorized destination.","verdict":"false_positive","confidence":0.97},{"id":"env_access:references/sdk/azure-monitor-opentelemetry-ts.md:15:environment-variable-object","reason":"The process.env object appears only in a direct read of the expected connection variable. There is no iteration, bulk collection, or disclosure of environment data.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/sdk/azure-monitor-opentelemetry-ts.md:15:environment-file-access","reason":"The TypeScript expression reads a process environment variable and does not access any environment file. The value configures the intended Azure Monitor exporter.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"9b9b19b1a8e826a18820c83027d528e4f75e27b444cde67cea6baab0f7aebc7c","subject_tree_hash":"b7ce7b8b75391515f687a15dda4893dc1386c873a9639f4e58c5284ea69ba71c","subject_plugin_path":"skills/microsoft/appinsights-instrumentation","audit_payload_hash":"607a1e0d48a93b10579b61979d9f2f37","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"9b9b19b1a8e826a18820c83027d528e4f75e27b444cde67cea6baab0f7aebc7c","treeHash":"b7ce7b8b75391515f687a15dda4893dc1386c873a9639f4e58c5284ea69ba71c","pluginPath":"skills/microsoft/appinsights-instrumentation","auditPayloadHash":"607a1e0d48a93b10579b61979d9f2f37"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/microsoft-appinsights-instrumentation/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}