{"data":{"skill":{"slug":"microsoft-azure-cost","name":"azure-cost","icon":"📦","repo":"https://github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/azure-cost/","status":"approved","author":"microsoft","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"c8192698-8301-4fe0-b5ae-1efbc16a835c","skill_id":"db48ab05-afd7-4c7b-b876-7ed596b4f8e9","version":2,"content_hash":"7bbbeccd9aca98699b3216f7bf2c374e","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis flagged many command, network, filesystem, environment, and weak-crypto patterns, but most are false positives caused by markdown examples, Azure API field names, and relative documentation links. No prompt injection or confirmed malicious exfiltration was found. The remaining risk is moderate because the skill can guide authenticated Azure CLI, AKS, and Redis operations, including cost-changing updates and deletion recommendations that require explicit user approval.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"cost-query/workflow.md","line_end":80,"line_start":73},{"file":"cost-forecast/workflow.md","line_end":83,"line_start":77},{"file":"cost-optimization/workflow.md","line_end":25,"line_start":20},{"file":"cost-optimization/azure-aks-anomalies.md","line_end":51,"line_start":42}]},{"factor":"network","evidence":[{"file":"cost-optimization/workflow.md","line_end":162,"line_start":156},{"file":"cost-forecast/error-handling.md","line_end":13,"line_start":13},{"file":"cost-query/workflow.md","line_end":137,"line_start":137}]},{"factor":"filesystem","evidence":[{"file":"cost-query/workflow.md","line_end":80,"line_start":49},{"file":"cost-optimization/workflow.md","line_end":150,"line_start":121},{"file":"cost-optimization/report-template.md","line_end":69,"line_start":63}]},{"factor":"env_access","evidence":[{"file":"cost-optimization/auth-best-practices.md","line_end":45,"line_start":43},{"file":"cost-optimization/auth-best-practices.md","line_end":106,"line_start":101}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Authenticated Azure Command Guidance","locations":[{"file":"cost-query/workflow.md","line_end":80,"line_start":73},{"file":"cost-forecast/workflow.md","line_end":83,"line_start":77},{"file":"cost-optimization/workflow.md","line_end":25,"line_start":20},{"file":"cost-optimization/azure-aks-anomalies.md","line_end":51,"line_start":42}],"confidence":0.82,"description":"The skill documents Azure CLI, PowerShell, kubectl, and azqr commands for cost analysis. These are instructional markdown examples, not executable skill code, but they can query tenant resources when a user is authenticated.","confidence_reasoning":"The command examples are clearly present and require authenticated Azure access. The risk is operational rather than malicious because the files frame them as user-directed cost analysis workflows."},{"title":"Destructive and Cost-Changing Recommendations Need Approval","locations":[{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"cost-optimization/services/redis/azure-cache-for-redis.md","line_end":28,"line_start":23},{"file":"cost-optimization/services/redis/azure-cache-for-redis.md","line_end":49,"line_start":45},{"file":"cost-optimization/azure-aks-cost-addon.md","line_end":40,"line_start":30}],"confidence":0.78,"description":"The skill includes Redis deletion guidance and AKS tier update commands. Main safety requirements require approval, but these references can still lead to resource deletion or increased spend if followed without review.","confidence_reasoning":"The affected files contain direct delete/update guidance, while SKILL.md adds an approval rule. This makes the issue a real workflow risk, but not evidence of malicious intent."},{"title":"Temporary File Creation and Cleanup Guidance","locations":[{"file":"cost-query/workflow.md","line_end":80,"line_start":49},{"file":"cost-optimization/workflow.md","line_end":150,"line_start":121},{"file":"cost-optimization/report-template.md","line_end":69,"line_start":63}],"confidence":0.68,"description":"The workflow asks users to create temporary request files and later remove a temp directory. Paths are fixed local folders, but users should verify working directory context before cleanup.","confidence_reasoning":"The filesystem actions are explicitly documented and scoped to temp/output paths. Risk is moderate-low because cleanup uses a fixed directory, but recursive deletion requires care."}],"low_findings":[{"title":"False Positive: Weak Cryptography Pattern Matches","locations":[{"file":"SKILL.md","line_end":3,"line_start":3},{"file":"cost-query/request-body-schema.md","line_end":28,"line_start":24},{"file":"cost-forecast/error-handling.md","line_end":25,"line_start":17}],"confidence":0.91,"description":"The weak-cryptography findings appear to match Azure Cost Management terms, markdown text, dates, or schema names rather than cryptographic algorithms used by executable code. No evidence found of MD5, SHA1, DES, or similar cryptographic use for security decisions.","confidence_reasoning":"Reviewed lines are markdown descriptions and API schema documentation. There is no executable crypto code in the cited context."},{"title":"False Positive: Relative Documentation Links","locations":[{"file":"cost-query/workflow.md","line_end":7,"line_start":7},{"file":"cost-optimization/workflow.md","line_end":5,"line_start":5},{"file":"cost-forecast/workflow.md","line_end":21,"line_start":21}],"confidence":0.93,"description":"Path traversal findings are relative markdown links between local documentation files, such as links back to SKILL.md or nearby workflow references. They do not read arbitrary filesystem paths.","confidence_reasoning":"The cited paths are documentation links used for navigation. No code path consumes user-controlled filesystem input."},{"title":"Benign Azure Documentation URLs","locations":[{"file":"cost-optimization/auth-best-practices.md","line_end":3,"line_start":3},{"file":"cost-optimization/workflow.md","line_end":162,"line_start":156},{"file":"cost-query/workflow.md","line_end":137,"line_start":137}],"confidence":0.9,"description":"Hardcoded URLs point to Microsoft Azure documentation, Azure pricing pages, or Azure Status. No evidence found of third-party exfiltration endpoints.","confidence_reasoning":"The network references are visible Microsoft-owned documentation or status/pricing pages. They support user validation rather than hidden outbound traffic."},{"title":"Benign Environment-Aware Credential Examples","locations":[{"file":"cost-optimization/auth-best-practices.md","line_end":45,"line_start":43},{"file":"cost-optimization/auth-best-practices.md","line_end":106,"line_start":101}],"confidence":0.86,"description":"Environment variable references are examples for selecting ManagedIdentityCredential versus DefaultAzureCredential. They do not print, transmit, or harvest secrets.","confidence_reasoning":"The examples use environment values to choose Azure identity behavior and explicitly warn against hardcoded credentials. No evidence found of credential exfiltration."}],"dangerous_patterns":[{"title":"Static Heuristic Dismissed: Code Execution Plus Network Plus Credentials","locations":[{"file":"cost-query/workflow.md","line_end":80,"line_start":73},{"file":"cost-optimization/auth-best-practices.md","line_end":117,"line_start":110},{"file":"cost-optimization/workflow.md","line_end":162,"line_start":156}],"confidence":0.88,"description":"The critical heuristic combined markdown command examples, Microsoft documentation links, and credential best-practice snippets. Context review found no executable code path that combines these into exfiltration or remote execution.","confidence_reasoning":"The underlying signals are real text patterns, but they occur in separate instructional markdown contexts. No malicious control flow or hidden execution mechanism was found."}],"files_scanned":21,"total_lines":2237,"audit_model":"codex","audited_at":"2026-06-30T08:10:42.599+00:00","created_at":"2026-06-30T10:03:12.054555+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}