{"data":{"skill":{"slug":"microsoft-azure-compliance","name":"azure-compliance","icon":"📦","repo":"https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-compliance/","status":"approved","author":"microsoft","authorVersion":"0.0.0-placeholder","skillstoreRevision":2},"audit":{"id":"4eb200ec-d239-4af2-982b-70f481412d59","skill_id":"6dc60ae6-2371-4670-a0c4-c30e2028f85e","version":5,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:5b30e59d77cd4b2199f04e05e8dcdee2e185f9b1b8ab70c7984db2455dec03a9:704797c5a3331e49acde623b73aa95dc9861d79f861d6e89a52c4712a2735233:736b696c6c732f6d6963726f736f66742f617a7572652d636f6d706c69616e6365:dd13e1cb2583bc003dff63b0f55e0350","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"The skill is documentation-driven and contains no executable scripts. All 76 alerts are benign Markdown, SDK, authentication, Azure endpoint, or scoped remediation examples. No prompt injection, credential exfiltration, covert execution, or malicious intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/auth-best-practices.md","line_end":16,"line_start":16},{"file":"references/auth-best-practices.md","line_end":81,"line_start":81},{"file":"references/auth-best-practices.md","line_end":87,"line_start":87},{"file":"references/azqr-remediation-patterns.md","line_end":356,"line_start":355},{"file":"references/azqr-remediation-patterns.md","line_end":360,"line_start":357},{"file":"references/azqr-remediation-patterns.md","line_end":19,"line_start":19},{"file":"references/azqr-remediation-patterns.md","line_end":145,"line_start":145},{"file":"references/azqr-remediation-patterns.md","line_end":146,"line_start":146},{"file":"references/azqr-remediation-patterns.md","line_end":183,"line_start":183},{"file":"references/azqr-remediation-patterns.md","line_end":250,"line_start":250},{"file":"references/azqr-remediation-patterns.md","line_end":278,"line_start":278},{"file":"references/azqr-remediation-patterns.md","line_end":353,"line_start":353},{"file":"references/azqr-remediation-patterns.md","line_end":348,"line_start":348},{"file":"references/sdk/azure-keyvault-keys-ts.md","line_end":15,"line_start":14},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":66,"line_start":66},{"file":"SKILL.md","line_end":89,"line_start":89}]},{"factor":"env_access","evidence":[{"file":"references/auth-best-practices.md","line_end":43,"line_start":43},{"file":"references/auth-best-practices.md","line_end":101,"line_start":101},{"file":"references/auth-best-practices.md","line_end":104,"line_start":104},{"file":"references/auth-best-practices.md","line_end":105,"line_start":105},{"file":"references/auth-best-practices.md","line_end":43,"line_start":43},{"file":"references/auth-best-practices.md","line_end":101,"line_start":101},{"file":"references/auth-best-practices.md","line_end":104,"line_start":104},{"file":"references/auth-best-practices.md","line_end":105,"line_start":105},{"file":"references/auth-best-practices.md","line_end":57,"line_start":57},{"file":"references/auth-best-practices.md","line_end":57,"line_start":57},{"file":"references/auth-best-practices.md","line_end":69,"line_start":69},{"file":"references/auth-best-practices.md","line_end":104,"line_start":104},{"file":"references/auth-best-practices.md","line_end":105,"line_start":105}]},{"factor":"network","evidence":[{"file":"references/sdk/azure-keyvault-certificates-rust.md","line_end":15,"line_start":15},{"file":"references/sdk/azure-keyvault-keys-rust.md","line_end":15,"line_start":15},{"file":"references/sdk/azure-keyvault-keys-ts.md","line_end":14,"line_start":14},{"file":"references/sdk/azure-keyvault-py.md","line_end":14,"line_start":14},{"file":"references/sdk/azure-keyvault-secrets-rust.md","line_end":15,"line_start":15},{"file":"references/sdk/azure-keyvault-secrets-ts.md","line_end":14,"line_start":14},{"file":"references/sdk/azure-security-keyvault-keys-dotnet.md","line_end":15,"line_start":15},{"file":"references/sdk/azure-security-keyvault-keys-java.md","line_end":28,"line_start":28},{"file":"references/sdk/azure-security-keyvault-secrets-java.md","line_end":28,"line_start":28}]},{"factor":"filesystem","evidence":[{"file":"references/sdk/azure-keyvault-keys-ts.md","line_end":18,"line_start":18},{"file":"references/sdk/azure-keyvault-py.md","line_end":18,"line_start":18},{"file":"references/sdk/azure-keyvault-secrets-ts.md","line_end":18,"line_start":18},{"file":"references/sdk/azure-security-keyvault-keys-dotnet.md","line_end":19,"line_start":19},{"file":"references/sdk/azure-security-keyvault-keys-java.md","line_end":22,"line_start":22},{"file":"references/sdk/azure-security-keyvault-secrets-java.md","line_end":22,"line_start":22}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":17,"total_lines":1445,"audit_model":"codex","audited_at":"2026-07-23T18:00:46.667+00:00","created_at":"2026-07-25T23:05:19.909008+00:00","static_findings":[{"id":"external_commands:references/auth-best-practices.md:16:powershell-invocation","file":"references/auth-best-practices.md","pattern":"PowerShell invocation","snippet":"| **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials","category":"external_commands","line_end":16,"severity":"high","line_start":16},{"id":"external_commands:references/auth-best-practices.md:81:powershell-invocation","file":"references/auth-best-practices.md","pattern":"PowerShell invocation","snippet":"3. **Azure PowerShell** — `Connect-AzAccount`","category":"external_commands","line_end":81,"severity":"high","line_start":81},{"id":"external_commands:references/auth-best-practices.md:87:powershell-invocation","file":"references/auth-best-practices.md","pattern":"PowerShell invocation","snippet":"// Local development only — uses CLI/PowerShell/VS Code credentials","category":"external_commands","line_end":87,"severity":"high","line_start":87},{"id":"env_access:references/auth-best-practices.md:43:environment-variable-access-dot-notation","file":"references/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"const credential = process.env.NODE_ENV === \"development\"","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:references/auth-best-practices.md:101:environment-variable-access-dot-notation","file":"references/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"if (process.env.NODE_ENV === \"development\") {","category":"env_access","line_end":101,"severity":"low","line_start":101},{"id":"env_access:references/auth-best-practices.md:104:environment-variable-access-dot-notation","file":"references/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"return process.env.AZURE_CLIENT_ID","category":"env_access","line_end":104,"severity":"low","line_start":104},{"id":"env_access:references/auth-best-practices.md:105:environment-variable-access-dot-notation","file":"references/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:references/auth-best-practices.md:43:environment-variable-object","file":"references/auth-best-practices.md","pattern":"Environment variable object","snippet":"const credential = process.env.NODE_ENV === \"development\"","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:references/auth-best-practices.md:101:environment-variable-object","file":"references/auth-best-practices.md","pattern":"Environment variable object","snippet":"if (process.env.NODE_ENV === \"development\") {","category":"env_access","line_end":101,"severity":"low","line_start":101},{"id":"env_access:references/auth-best-practices.md:104:environment-variable-object","file":"references/auth-best-practices.md","pattern":"Environment variable object","snippet":"return process.env.AZURE_CLIENT_ID","category":"env_access","line_end":104,"severity":"low","line_start":104},{"id":"env_access:references/auth-best-practices.md:105:environment-variable-object","file":"references/auth-best-practices.md","pattern":"Environment variable object","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:references/auth-best-practices.md:57:python-getenv-function","file":"references/auth-best-practices.md","pattern":"Python getenv function","snippet":"if os.getenv(\"AZURE_FUNCTIONS_ENVIRONMENT\") == \"Development\"","category":"env_access","line_end":57,"severity":"low","line_start":57},{"id":"env_access:references/auth-best-practices.md:57:getenv-function-call","file":"references/auth-best-practices.md","pattern":"getenv function call","snippet":"if os.getenv(\"AZURE_FUNCTIONS_ENVIRONMENT\") == \"Development\"","category":"env_access","line_end":57,"severity":"low","line_start":57},{"id":"env_access:references/auth-best-practices.md:69:getenv-function-call","file":"references/auth-best-practices.md","pattern":"getenv function call","snippet":"var credential = \"Development\".equals(System.getenv(\"AZURE_FUNCTIONS_ENVIRONMENT\"))","category":"env_access","line_end":69,"severity":"low","line_start":69},{"id":"env_access:references/auth-best-practices.md:104:azure-credential-environment-variables","file":"references/auth-best-practices.md","pattern":"Azure credential environment variables","snippet":"return process.env.AZURE_CLIENT_ID","category":"env_access","line_end":104,"severity":"high","line_start":104},{"id":"env_access:references/auth-best-practices.md:105:azure-credential-environment-variables","file":"references/auth-best-practices.md","pattern":"Azure credential environment variables","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"env_access","line_end":105,"severity":"high","line_start":105},{"id":"sensitive:references/auth-best-practices.md:43:environment-file-access","file":"references/auth-best-practices.md","pattern":"Environment file access","snippet":"const credential = process.env.NODE_ENV === \"development\"","category":"sensitive","line_end":43,"severity":"high","line_start":43},{"id":"sensitive:references/auth-best-practices.md:101:environment-file-access","file":"references/auth-best-practices.md","pattern":"Environment file access","snippet":"if (process.env.NODE_ENV === \"development\") {","category":"sensitive","line_end":101,"severity":"high","line_start":101},{"id":"sensitive:references/auth-best-practices.md:104:environment-file-access","file":"references/auth-best-practices.md","pattern":"Environment file access","snippet":"return process.env.AZURE_CLIENT_ID","category":"sensitive","line_end":104,"severity":"high","line_start":104},{"id":"sensitive:references/auth-best-practices.md:105:environment-file-access","file":"references/auth-best-practices.md","pattern":"Environment file access","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"sensitive","line_end":105,"severity":"high","line_start":105},{"id":"external_commands:references/azqr-remediation-patterns.md:355:ruby-shell-backtick-execution","file":"references/azqr-remediation-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"--account-name $sa.name `","category":"external_commands","line_end":356,"severity":"medium","line_start":355},{"id":"external_commands:references/azqr-remediation-patterns.md:357:ruby-shell-backtick-execution","file":"references/azqr-remediation-patterns.md","pattern":"Ruby/shell backtick execution","snippet":"--enable-delete-retention true `","category":"external_commands","line_end":360,"severity":"medium","line_start":357},{"id":"external_commands:references/azqr-remediation-patterns.md:19:shell-command-substitution","file":"references/azqr-remediation-patterns.md","pattern":"Shell command substitution","snippet":"--private-connection-resource-id $(az storage account show -n <storage-name> -g <rg-name> --query id","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:references/azqr-remediation-patterns.md:145:shell-command-substitution","file":"references/azqr-remediation-patterns.md","pattern":"Shell command substitution","snippet":"--resource $(az vm show -g <rg-name> -n <vm-name> --query id -o tsv) \\","category":"external_commands","line_end":145,"severity":"medium","line_start":145},{"id":"external_commands:references/azqr-remediation-patterns.md:146:shell-command-substitution","file":"references/azqr-remediation-patterns.md","pattern":"Shell command substitution","snippet":"--workspace $(az monitor log-analytics workspace show -g <rg-name> -n <workspace-name> --query id -o","category":"external_commands","line_end":146,"severity":"medium","line_start":146},{"id":"external_commands:references/azqr-remediation-patterns.md:183:shell-command-substitution","file":"references/azqr-remediation-patterns.md","pattern":"Shell command substitution","snippet":"--vm $(az vm show -g <rg-name> -n <vm-name> --query id -o tsv) \\","category":"external_commands","line_end":183,"severity":"medium","line_start":183},{"id":"external_commands:references/azqr-remediation-patterns.md:250:shell-command-substitution","file":"references/azqr-remediation-patterns.md","pattern":"Shell command substitution","snippet":"--lawri $(az monitor log-analytics workspace show -g <rg-name> -n <workspace-name> --query id -o tsv","category":"external_commands","line_end":250,"severity":"medium","line_start":250},{"id":"external_commands:references/azqr-remediation-patterns.md:278:shell-command-substitution","file":"references/azqr-remediation-patterns.md","pattern":"Shell command substitution","snippet":"--private-connection-resource-id $(az sql server show -g <rg-name> -n <server-name> --query id -o ts","category":"external_commands","line_end":278,"severity":"medium","line_start":278},{"id":"external_commands:references/azqr-remediation-patterns.md:353:shell-command-substitution","file":"references/azqr-remediation-patterns.md","pattern":"Shell command substitution","snippet":"Write-Host \"Enabling soft delete on $($sa.name)...\"","category":"external_commands","line_end":353,"severity":"medium","line_start":353},{"id":"external_commands:references/azqr-remediation-patterns.md:348:powershell-invocation","file":"references/azqr-remediation-patterns.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":348,"severity":"high","line_start":348},{"id":"blocker:references/azqr-remediation-patterns.md:19:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--private-connection-resource-id $(az storage account show -n <storage-name> -g <rg-name> --query id","category":"blocker","line_end":19,"severity":"low","line_start":19},{"id":"blocker:references/azqr-remediation-patterns.md:20:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--group-id blob \\","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"blocker:references/azqr-remediation-patterns.md:37:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"id: subnet.id","category":"blocker","line_end":38,"severity":"low","line_start":37},{"id":"blocker:references/azqr-remediation-patterns.md:43:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"privateLinkServiceId: storageAccount.id","category":"blocker","line_end":44,"severity":"low","line_start":43},{"id":"blocker:references/azqr-remediation-patterns.md:145:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--resource $(az vm show -g <rg-name> -n <vm-name> --query id -o tsv) \\","category":"blocker","line_end":145,"severity":"low","line_start":145},{"id":"blocker:references/azqr-remediation-patterns.md:146:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--workspace $(az monitor log-analytics workspace show -g <rg-name> -n <workspace-name> --query id -o","category":"blocker","line_end":146,"severity":"low","line_start":146},{"id":"blocker:references/azqr-remediation-patterns.md:156:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"workspaceId: logAnalyticsWorkspace.id","category":"blocker","line_end":157,"severity":"low","line_start":156},{"id":"blocker:references/azqr-remediation-patterns.md:183:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--vm $(az vm show -g <rg-name> -n <vm-name> --query id -o tsv) \\","category":"blocker","line_end":183,"severity":"low","line_start":183},{"id":"blocker:references/azqr-remediation-patterns.md:214:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"logAnalyticsWorkspaceResourceId: logAnalyticsWorkspace.id","category":"blocker","line_end":215,"severity":"low","line_start":214},{"id":"blocker:references/azqr-remediation-patterns.md:250:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--lawri $(az monitor log-analytics workspace show -g <rg-name> -n <workspace-name> --query id -o tsv","category":"blocker","line_end":250,"severity":"low","line_start":250},{"id":"blocker:references/azqr-remediation-patterns.md:278:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--private-connection-resource-id $(az sql server show -g <rg-name> -n <server-name> --query id -o ts","category":"blocker","line_end":278,"severity":"low","line_start":278},{"id":"blocker:references/azqr-remediation-patterns.md:279:system-reconnaissance","file":"references/azqr-remediation-patterns.md","pattern":"System reconnaissance","snippet":"--group-id sqlServer \\","category":"blocker","line_end":279,"severity":"low","line_start":279},{"id":"blocker:references/azure-keyvault-expiration-audit.md:47:system-reconnaissance","file":"references/azure-keyvault-expiration-audit.md","pattern":"System reconnaissance","snippet":"- **notBefore**: When resource becomes valid","category":"blocker","line_end":48,"severity":"low","line_start":47},{"id":"blocker:references/azure-keyvault-expiration-audit.md:72:system-reconnaissance","file":"references/azure-keyvault-expiration-audit.md","pattern":"System reconnaissance","snippet":"- Configure Azure Event Grid for 30-day advance notifications","category":"blocker","line_end":72,"severity":"low","line_start":72},{"id":"blocker:references/azure-resource-graph.md:83:system-reconnaissance","file":"references/azure-resource-graph.md","pattern":"System reconnaissance","snippet":"| project rgName=name, rgId=id","category":"blocker","line_end":84,"severity":"low","line_start":83},{"id":"network:references/sdk/azure-keyvault-certificates-rust.md:15:hardcoded-url","file":"references/sdk/azure-keyvault-certificates-rust.md","pattern":"Hardcoded URL","snippet":"let client = CertificateClient::new(\"https://<vault>.vault.azure.net/\", credential.clone(), None)?;","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:references/sdk/azure-keyvault-keys-rust.md:15:hardcoded-url","file":"references/sdk/azure-keyvault-keys-rust.md","pattern":"Hardcoded URL","snippet":"let client = KeyClient::new(\"https://<vault>.vault.azure.net/\", credential.clone(), None)?;","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"external_commands:references/sdk/azure-keyvault-keys-ts.md:14:ruby-shell-backtick-execution","file":"references/sdk/azure-keyvault-keys-ts.md","pattern":"Ruby/shell backtick execution","snippet":"const keyClient = new KeyClient(`https://${vaultName}.vault.azure.net`, new DefaultAzureCredential()","category":"external_commands","line_end":15,"severity":"medium","line_start":14},{"id":"network:references/sdk/azure-keyvault-keys-ts.md:14:hardcoded-url","file":"references/sdk/azure-keyvault-keys-ts.md","pattern":"Hardcoded URL","snippet":"const keyClient = new KeyClient(`https://${vaultName}.vault.azure.net`, new DefaultAzureCredential()","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"filesystem:references/sdk/azure-keyvault-keys-ts.md:18:path-traversal-sequence","file":"references/sdk/azure-keyvault-keys-ts.md","pattern":"Path traversal sequence","snippet":"- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCrede","category":"filesystem","line_end":18,"severity":"high","line_start":18},{"id":"network:references/sdk/azure-keyvault-py.md:14:hardcoded-url","file":"references/sdk/azure-keyvault-py.md","pattern":"Hardcoded URL","snippet":"client = SecretClient(vault_url=\"https://<vault>.vault.azure.net/\", credential=DefaultAzureCredentia","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"filesystem:references/sdk/azure-keyvault-py.md:18:path-traversal-sequence","file":"references/sdk/azure-keyvault-py.md","pattern":"Path traversal sequence","snippet":"- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCrede","category":"filesystem","line_end":18,"severity":"high","line_start":18},{"id":"sensitive:references/sdk/azure-keyvault-py.md:13:certificate-key-files","file":"references/sdk/azure-keyvault-py.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.secrets import SecretClient","category":"sensitive","line_end":13,"severity":"high","line_start":13},{"id":"network:references/sdk/azure-keyvault-secrets-rust.md:15:hardcoded-url","file":"references/sdk/azure-keyvault-secrets-rust.md","pattern":"Hardcoded URL","snippet":"let client = SecretClient::new(\"https://<vault>.vault.azure.net/\", credential.clone(), None)?;","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"network:references/sdk/azure-keyvault-secrets-ts.md:14:hardcoded-url","file":"references/sdk/azure-keyvault-secrets-ts.md","pattern":"Hardcoded URL","snippet":"const client = new SecretClient(\"https://<vault>.vault.azure.net\", new DefaultAzureCredential());","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"filesystem:references/sdk/azure-keyvault-secrets-ts.md:18:path-traversal-sequence","file":"references/sdk/azure-keyvault-secrets-ts.md","pattern":"Path traversal sequence","snippet":"- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCrede","category":"filesystem","line_end":18,"severity":"high","line_start":18},{"id":"network:references/sdk/azure-security-keyvault-keys-dotnet.md:15:hardcoded-url","file":"references/sdk/azure-security-keyvault-keys-dotnet.md","pattern":"Hardcoded URL","snippet":"var client = new KeyClient(new Uri(\"https://<vault>.vault.azure.net\"), new DefaultAzureCredential())","category":"network","line_end":15,"severity":"low","line_start":15},{"id":"filesystem:references/sdk/azure-security-keyvault-keys-dotnet.md:19:path-traversal-sequence","file":"references/sdk/azure-security-keyvault-keys-dotnet.md","pattern":"Path traversal sequence","snippet":"- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCrede","category":"filesystem","line_end":19,"severity":"high","line_start":19},{"id":"network:references/sdk/azure-security-keyvault-keys-java.md:28:hardcoded-url","file":"references/sdk/azure-security-keyvault-keys-java.md","pattern":"Hardcoded URL","snippet":".vaultUrl(\"https://<vault>.vault.azure.net\")","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"filesystem:references/sdk/azure-security-keyvault-keys-java.md:22:path-traversal-sequence","file":"references/sdk/azure-security-keyvault-keys-java.md","pattern":"Path traversal sequence","snippet":"> **Auth:** `DefaultAzureCredential` is for local development. See [auth-best-practices.md](../auth-","category":"filesystem","line_end":22,"severity":"high","line_start":22},{"id":"sensitive:references/sdk/azure-security-keyvault-keys-java.md:25:certificate-key-files","file":"references/sdk/azure-security-keyvault-keys-java.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.keys.KeyClientBuilder;","category":"sensitive","line_end":25,"severity":"high","line_start":25},{"id":"network:references/sdk/azure-security-keyvault-secrets-java.md:28:hardcoded-url","file":"references/sdk/azure-security-keyvault-secrets-java.md","pattern":"Hardcoded URL","snippet":".vaultUrl(\"https://<vault>.vault.azure.net\")","category":"network","line_end":28,"severity":"low","line_start":28},{"id":"filesystem:references/sdk/azure-security-keyvault-secrets-java.md:22:path-traversal-sequence","file":"references/sdk/azure-security-keyvault-secrets-java.md","pattern":"Path traversal sequence","snippet":"> **Auth:** `DefaultAzureCredential` is for local development. See [auth-best-practices.md](../auth-","category":"filesystem","line_end":22,"severity":"high","line_start":22},{"id":"sensitive:references/sdk/azure-security-keyvault-secrets-java.md:25:certificate-key-files","file":"references/sdk/azure-security-keyvault-secrets-java.md","pattern":"Certificate/key files","snippet":"import com.azure.security.keyvault.secrets.SecretClientBuilder;","category":"sensitive","line_end":25,"severity":"high","line_start":25},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Authentication: user is logged in to Azure via `az login`","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_extension_azqr` | Run azqr compliance scans |","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_subscription_list` | List available subscriptions |","category":"external_commands","line_end":59,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_group_list` | List resource groups |","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keyvault_key_list` | List all keys in vault |","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keyvault_key_get` | Get key details including expiration |","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keyvault_secret_list` | List all secrets in vault |","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keyvault_secret_get` | Get secret details including expiration |","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keyvault_certificate_list` | List all certificates in vault |","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keyvault_certificate_get` | Get certificate details including expiration |","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Authentication required | \"Please login\" | Run `az login` and retry |","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"blocker:SKILL.md:96:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- Track findings over time and verify remediation effectiveness","category":"blocker","line_end":97,"severity":"low","line_start":96}],"finding_verdicts":[{"id":"external_commands:references/auth-best-practices.md:16:powershell-invocation","reason":"This table describes credential sources used by DefaultAzureCredential. It does not invoke PowerShell or execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/auth-best-practices.md:81:powershell-invocation","reason":"Connect-AzAccount is shown as a named local authentication option in documentation. No automatic PowerShell execution is present.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/auth-best-practices.md:87:powershell-invocation","reason":"The matched text is a TypeScript comment describing local credential sources. It contains no process invocation.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:43:environment-variable-access-dot-notation","reason":"The documentation sample reads NODE_ENV only to choose a development credential. It neither accesses a secret nor transmits environment data.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:101:environment-variable-access-dot-notation","reason":"The documentation sample reads NODE_ENV only to choose a development credential. It neither accesses a secret nor transmits environment data.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:104:environment-variable-access-dot-notation","reason":"The sample reads AZURE_CLIENT_ID to select a user-assigned managed identity. A client identifier is not a credential secret, and no exfiltration occurs.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/auth-best-practices.md:105:environment-variable-access-dot-notation","reason":"The sample reads AZURE_CLIENT_ID to select a user-assigned managed identity. A client identifier is not a credential secret, and no exfiltration occurs.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/auth-best-practices.md:43:environment-variable-object","reason":"The documentation sample reads NODE_ENV only to choose a development credential. It neither accesses a secret nor transmits environment data.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:101:environment-variable-object","reason":"The documentation sample reads NODE_ENV only to choose a development credential. It neither accesses a secret nor transmits environment data.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:104:environment-variable-object","reason":"The sample reads AZURE_CLIENT_ID to select a user-assigned managed identity. A client identifier is not a credential secret, and no exfiltration occurs.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/auth-best-practices.md:105:environment-variable-object","reason":"The sample reads AZURE_CLIENT_ID to select a user-assigned managed identity. A client identifier is not a credential secret, and no exfiltration occurs.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/auth-best-practices.md:57:python-getenv-function","reason":"The sample reads AZURE_FUNCTIONS_ENVIRONMENT only to detect local development. It does not enumerate, persist, or transmit environment values.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:57:getenv-function-call","reason":"The sample reads AZURE_FUNCTIONS_ENVIRONMENT only to detect local development. It does not enumerate, persist, or transmit environment values.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:69:getenv-function-call","reason":"The sample reads AZURE_FUNCTIONS_ENVIRONMENT only to detect local development. It does not enumerate, persist, or transmit environment values.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/auth-best-practices.md:104:azure-credential-environment-variables","reason":"AZURE_CLIENT_ID is used as the public identifier for a managed identity, not as an authentication secret. The example does not read tokens or client secrets.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/auth-best-practices.md:105:azure-credential-environment-variables","reason":"AZURE_CLIENT_ID is used as the public identifier for a managed identity, not as an authentication secret. The example does not read tokens or client secrets.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:references/auth-best-practices.md:43:environment-file-access","reason":"The code accesses process.env.NODE_ENV in memory and never opens a .env file. The environment-file rule matched a property access incorrectly.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/auth-best-practices.md:101:environment-file-access","reason":"The code accesses process.env.NODE_ENV in memory and never opens a .env file. The environment-file rule matched a property access incorrectly.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/auth-best-practices.md:104:environment-file-access","reason":"The code accesses process.env.AZURE_CLIENT_ID in memory and performs no filesystem operation. No environment file or secret file is read.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/auth-best-practices.md:105:environment-file-access","reason":"The code accesses process.env.AZURE_CLIENT_ID in memory and performs no filesystem operation. No environment file or secret file is read.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/azqr-remediation-patterns.md:355:ruby-shell-backtick-execution","reason":"The backtick is PowerShell line-continuation syntax inside a labeled documentation example. It is not Ruby execution or a shell evaluation primitive.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/azqr-remediation-patterns.md:357:ruby-shell-backtick-execution","reason":"The backtick is PowerShell line-continuation syntax inside a labeled documentation example. It is not Ruby execution or a shell evaluation primitive.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/azqr-remediation-patterns.md:19:shell-command-substitution","reason":"This is a documented Azure CLI remediation example using a fixed az lookup to obtain a resource ID. Placeholders are explicit, with no hidden execution or untrusted eval.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:references/azqr-remediation-patterns.md:145:shell-command-substitution","reason":"This is a documented Azure CLI remediation example using a fixed az lookup to obtain a resource ID. Placeholders are explicit, with no hidden execution or untrusted eval.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:references/azqr-remediation-patterns.md:146:shell-command-substitution","reason":"This is a documented Azure CLI remediation example using a fixed az lookup to obtain a resource ID. Placeholders are explicit, with no hidden execution or untrusted eval.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:references/azqr-remediation-patterns.md:183:shell-command-substitution","reason":"This is a documented Azure CLI remediation example using a fixed az lookup to obtain a resource ID. Placeholders are explicit, with no hidden execution or untrusted eval.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:references/azqr-remediation-patterns.md:250:shell-command-substitution","reason":"This is a documented Azure CLI remediation example using a fixed az lookup to obtain a resource ID. Placeholders are explicit, with no hidden execution or untrusted eval.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:references/azqr-remediation-patterns.md:278:shell-command-substitution","reason":"This is a documented Azure CLI remediation example using a fixed az lookup to obtain a resource ID. Placeholders are explicit, with no hidden execution or untrusted eval.","verdict":"false_positive","confidence":0.93},{"id":"external_commands:references/azqr-remediation-patterns.md:353:shell-command-substitution","reason":"The matched syntax is PowerShell property interpolation in a status message. It does not launch a nested command or evaluate user-supplied code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/azqr-remediation-patterns.md:348:powershell-invocation","reason":"The match is the language label on a Markdown code fence. It identifies example syntax and does not invoke PowerShell.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/azqr-remediation-patterns.md:19:system-reconnaissance","reason":"The example performs a scoped Azure resource-ID lookup required for a named remediation. It targets user-selected resources and shows no covert or unauthorized discovery intent.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/azqr-remediation-patterns.md:20:system-reconnaissance","reason":"The matched value is a fixed Azure private-endpoint group identifier in a remediation example. It does not enumerate hosts, networks, or accounts.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/azqr-remediation-patterns.md:37:system-reconnaissance","reason":"The matched value is a Bicep resource-ID property used to connect explicitly declared Azure resources. It performs no discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/azqr-remediation-patterns.md:43:system-reconnaissance","reason":"The matched value is a Bicep resource-ID property used to connect explicitly declared Azure resources. It performs no discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/azqr-remediation-patterns.md:145:system-reconnaissance","reason":"The example performs a scoped Azure resource-ID lookup required for a named remediation. It targets user-selected resources and shows no covert or unauthorized discovery intent.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/azqr-remediation-patterns.md:146:system-reconnaissance","reason":"The example performs a scoped Azure resource-ID lookup required for a named remediation. It targets user-selected resources and shows no covert or unauthorized discovery intent.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/azqr-remediation-patterns.md:156:system-reconnaissance","reason":"The matched value is a Bicep resource-ID property used to connect explicitly declared Azure resources. It performs no discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/azqr-remediation-patterns.md:183:system-reconnaissance","reason":"The example performs a scoped Azure resource-ID lookup required for a named remediation. It targets user-selected resources and shows no covert or unauthorized discovery intent.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/azqr-remediation-patterns.md:214:system-reconnaissance","reason":"The matched value is a Bicep resource-ID property used to connect explicitly declared Azure resources. It performs no discovery or reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/azqr-remediation-patterns.md:250:system-reconnaissance","reason":"The example performs a scoped Azure resource-ID lookup required for a named remediation. It targets user-selected resources and shows no covert or unauthorized discovery intent.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/azqr-remediation-patterns.md:278:system-reconnaissance","reason":"The example performs a scoped Azure resource-ID lookup required for a named remediation. It targets user-selected resources and shows no covert or unauthorized discovery intent.","verdict":"false_positive","confidence":0.96},{"id":"blocker:references/azqr-remediation-patterns.md:279:system-reconnaissance","reason":"The matched value is a fixed Azure private-endpoint group identifier in a remediation example. It does not enumerate hosts, networks, or accounts.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/azure-keyvault-expiration-audit.md:47:system-reconnaissance","reason":"The text defines the notBefore metadata field for a Key Vault item. It contains no discovery command or reconnaissance behavior.","verdict":"false_positive","confidence":1},{"id":"blocker:references/azure-keyvault-expiration-audit.md:72:system-reconnaissance","reason":"The text recommends expiration notifications through Azure Event Grid. It does not inspect systems or enumerate network information.","verdict":"false_positive","confidence":1},{"id":"blocker:references/azure-resource-graph.md:83:system-reconnaissance","reason":"This is a documented compliance query that projects names and IDs for resource groups in the authorized Azure scope. It has no covert discovery or malicious intent.","verdict":"false_positive","confidence":0.97},{"id":"network:references/sdk/azure-keyvault-certificates-rust.md:15:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-keyvault-keys-rust.md:15:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/sdk/azure-keyvault-keys-ts.md:14:ruby-shell-backtick-execution","reason":"The backticks delimit a TypeScript template literal used to construct an Azure Key Vault URL. No shell or Ruby command is executed.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-keyvault-keys-ts.md:14:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/sdk/azure-keyvault-keys-ts.md:18:path-traversal-sequence","reason":"The ../ sequence appears only in a relative Markdown link to auth-best-practices.md. No filesystem path is accepted, resolved, or accessed.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-keyvault-py.md:14:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/sdk/azure-keyvault-py.md:18:path-traversal-sequence","reason":"The ../ sequence appears only in a relative Markdown link to auth-best-practices.md. No filesystem path is accepted, resolved, or accessed.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/sdk/azure-keyvault-py.md:13:certificate-key-files","reason":"The line imports an Azure Key Vault SDK client class. It does not open certificate files, private keys, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-keyvault-secrets-rust.md:15:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-keyvault-secrets-ts.md:14:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/sdk/azure-keyvault-secrets-ts.md:18:path-traversal-sequence","reason":"The ../ sequence appears only in a relative Markdown link to auth-best-practices.md. No filesystem path is accepted, resolved, or accessed.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-security-keyvault-keys-dotnet.md:15:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/sdk/azure-security-keyvault-keys-dotnet.md:19:path-traversal-sequence","reason":"The ../ sequence appears only in a relative Markdown link to auth-best-practices.md. No filesystem path is accepted, resolved, or accessed.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-security-keyvault-keys-java.md:28:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/sdk/azure-security-keyvault-keys-java.md:22:path-traversal-sequence","reason":"The ../ sequence appears only in a relative Markdown link to auth-best-practices.md. No filesystem path is accepted, resolved, or accessed.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/sdk/azure-security-keyvault-keys-java.md:25:certificate-key-files","reason":"The line imports an Azure Key Vault SDK client class. It does not open certificate files, private keys, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"network:references/sdk/azure-security-keyvault-secrets-java.md:28:hardcoded-url","reason":"The URL is a placeholder for the official vault.azure.net service endpoint in an SDK example. It does not send data to an unrelated or attacker-controlled host.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/sdk/azure-security-keyvault-secrets-java.md:22:path-traversal-sequence","reason":"The ../ sequence appears only in a relative Markdown link to auth-best-practices.md. No filesystem path is accepted, resolved, or accessed.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/sdk/azure-security-keyvault-secrets-java.md:25:certificate-key-files","reason":"The line imports an Azure Key Vault SDK client class. It does not open certificate files, private keys, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"Backticks provide Markdown inline-code formatting for an Azure login command. The skill does not execute Ruby or use shell backticks for evaluation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"Backticks format an MCP tool name as inline Markdown in a reference table. They do not perform command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"Backticks provide Markdown inline-code formatting for an Azure login command. The skill does not execute Ruby or use shell backticks for evaluation.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:96:network-reconnaissance","reason":"The line recommends tracking audit findings over time. It contains no network scan, endpoint enumeration, or reconnaissance instruction.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"5b30e59d77cd4b2199f04e05e8dcdee2e185f9b1b8ab70c7984db2455dec03a9","subject_tree_hash":"704797c5a3331e49acde623b73aa95dc9861d79f861d6e89a52c4712a2735233","subject_plugin_path":"skills/microsoft/azure-compliance","audit_payload_hash":"dd13e1cb2583bc003dff63b0f55e0350","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"5b30e59d77cd4b2199f04e05e8dcdee2e185f9b1b8ab70c7984db2455dec03a9","treeHash":"704797c5a3331e49acde623b73aa95dc9861d79f861d6e89a52c4712a2735233","pluginPath":"skills/microsoft/azure-compliance","auditPayloadHash":"dd13e1cb2583bc003dff63b0f55e0350"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/microsoft-azure-compliance/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}