{"data":{"skill":{"slug":"microsoft-azure-cost","name":"azure-cost","icon":"📦","repo":"https://github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/azure-cost/","status":"approved","author":"microsoft","authorVersion":"1.2.2","skillstoreRevision":2},"audit":{"id":"9ed7362c-42e1-460d-b485-5c51b6bd9f5f","skill_id":"db48ab05-afd7-4c7b-b876-7ed596b4f8e9","version":5,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:1bc522b995b8abd42b189cc3478031d52d9230ab41dde0e19a5db39832c85abc:af0a3c4652dfe6d32e299703d9ab4033dbd107d5be596742fdc62af9aa32d289:736b696c6c732f6d6963726f736f66742f617a7572652d636f7374:8c64e2e55c4e0f776fac31ce1f7c3626","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Review confirmed one high-risk cleanup command that recursively removes a relative temp directory without proving the skill owns it. Two semantic issues remain: unqualified resource deletion advice and budget creation without an explicit approval checkpoint. The other 79 static findings are documentation false positives involving Markdown links, code fences, official URLs, and non-secret environment selectors.","remediation":[{"issue":"Cleanup recursively removes the shared relative temp directory.","severity":"high","suggestion":"Use a unique skill-owned directory and delete only files created during the current run after verifying the resolved path."},{"issue":"The report template describes discovered resources as immediately deletable.","severity":"high","suggestion":"Require dependency checks, utilization validation, a dry run, rollback guidance, and explicit approval before presenting or executing deletion commands."},{"issue":"The anomaly workflow can create an Azure budget without an approval checkpoint.","severity":"medium","suggestion":"Present the proposed amount, scope, dates, thresholds, and recipients, then require explicit confirmation before executing the command."}],"risk_factor_evidence":[{"factor":"filesystem","evidence":[{"file":"cost-forecast/examples.md","line_end":3,"line_start":3},{"file":"cost-forecast/workflow.md","line_end":5,"line_start":5},{"file":"cost-forecast/workflow.md","line_end":21,"line_start":21},{"file":"cost-forecast/workflow.md","line_end":44,"line_start":44},{"file":"cost-forecast/workflow.md","line_end":93,"line_start":93},{"file":"cost-optimization/sdk/azure-resource-manager-redis-dotnet.md","line_end":13,"line_start":13},{"file":"cost-optimization/sdk/azure-resource-manager-redis-dotnet.md","line_end":24,"line_start":24},{"file":"cost-optimization/workflow.md","line_end":5,"line_start":5},{"file":"cost-optimization/workflow.md","line_end":127,"line_start":127},{"file":"cost-optimization/workflow.md","line_end":160,"line_start":160},{"file":"cost-query/examples.md","line_end":3,"line_start":3},{"file":"cost-query/workflow.md","line_end":7,"line_start":7}]},{"factor":"external_commands","evidence":[{"file":"cost-forecast/workflow.md","line_end":82,"line_start":81},{"file":"cost-forecast/workflow.md","line_end":77,"line_start":77},{"file":"cost-optimization/auth-best-practices.md","line_end":16,"line_start":16},{"file":"cost-optimization/auth-best-practices.md","line_end":81,"line_start":81},{"file":"cost-optimization/auth-best-practices.md","line_end":87,"line_start":87},{"file":"cost-optimization/azure-quick-review.md","line_end":25,"line_start":25},{"file":"cost-optimization/report-template.md","line_end":49,"line_start":47},{"file":"cost-optimization/report-template.md","line_end":67,"line_start":67},{"file":"cost-optimization/workflow.md","line_end":187,"line_start":186},{"file":"cost-optimization/workflow.md","line_end":189,"line_start":188},{"file":"cost-optimization/workflow.md","line_end":192,"line_start":190},{"file":"cost-optimization/workflow.md","line_end":20,"line_start":20},{"file":"cost-optimization/workflow.md","line_end":120,"line_start":120},{"file":"cost-optimization/workflow.md","line_end":180,"line_start":180},{"file":"cost-query/workflow.md","line_end":80,"line_start":79},{"file":"cost-query/workflow.md","line_end":112,"line_start":111},{"file":"cost-query/workflow.md","line_end":73,"line_start":73},{"file":"cost-query/workflow.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":35,"line_start":35}]},{"factor":"env_access","evidence":[{"file":"cost-optimization/auth-best-practices.md","line_end":43,"line_start":43},{"file":"cost-optimization/auth-best-practices.md","line_end":101,"line_start":101},{"file":"cost-optimization/auth-best-practices.md","line_end":104,"line_start":104},{"file":"cost-optimization/auth-best-practices.md","line_end":105,"line_start":105},{"file":"cost-optimization/auth-best-practices.md","line_end":43,"line_start":43},{"file":"cost-optimization/auth-best-practices.md","line_end":101,"line_start":101},{"file":"cost-optimization/auth-best-practices.md","line_end":104,"line_start":104},{"file":"cost-optimization/auth-best-practices.md","line_end":105,"line_start":105},{"file":"cost-optimization/auth-best-practices.md","line_end":57,"line_start":57},{"file":"cost-optimization/auth-best-practices.md","line_end":57,"line_start":57},{"file":"cost-optimization/auth-best-practices.md","line_end":69,"line_start":69},{"file":"cost-optimization/auth-best-practices.md","line_end":104,"line_start":104},{"file":"cost-optimization/auth-best-practices.md","line_end":105,"line_start":105}]},{"factor":"network","evidence":[{"file":"cost-optimization/azure-aks-anomalies.md","line_end":13,"line_start":13},{"file":"cost-optimization/report-template.md","line_end":56,"line_start":56},{"file":"cost-optimization/workflow.md","line_end":158,"line_start":158}]}],"critical_findings":[],"high_findings":[{"title":"PowerShell invocation","locations":[{"file":"cost-optimization/report-template.md","line_end":67,"line_start":67}],"confidence":0.98,"description":"```powershell","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The PowerShell block recursively force-deletes the relative temp directory. It does not verify that the directory belongs to this skill."},{"title":"Unqualified Resource Deletion Recommendation","locations":[{"file":"cost-optimization/report-template.md","line_end":24,"line_start":23}],"confidence":0.95,"description":"The report template labels azqr-identified resources as immediately deletable. This can encourage destructive changes without dependency validation or explicit approval.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The template explicitly places azqr results under resources that can be deleted immediately. No validation or approval condition appears in that section."}],"medium_findings":[{"title":"Azure Budget Creation Without Approval Checkpoint","locations":[{"file":"cost-optimization/azure-aks-anomalies.md","line_end":77,"line_start":65}],"confidence":0.92,"description":"The anomaly workflow supplies a budget creation command with notification recipients but no explicit confirmation step. An investigation can therefore modify subscription state.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The cited section directly provides az consumption budget create after diagnostic steps. It does not require confirmation before the state-changing command."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":23,"total_lines":2431,"audit_model":"codex","audited_at":"2026-07-23T18:20:33.783+00:00","created_at":"2026-07-25T23:05:41.775381+00:00","static_findings":[{"id":"blocker:cost-forecast/error-handling.md:7:system-reconnaissance","file":"cost-forecast/error-handling.md","pattern":"System reconnaissance","snippet":"| 400 | Bad Request | Invalid request body, missing `dataset`, past-only dates, invalid field depend","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:cost-forecast/error-handling.md:10:system-reconnaissance","file":"cost-forecast/error-handling.md","pattern":"System reconnaissance","snippet":"| 404 | Not Found | Invalid scope URL — subscription, resource group, or billing account not found |","category":"blocker","line_end":10,"severity":"low","line_start":10},{"id":"blocker:cost-forecast/error-handling.md:20:system-reconnaissance","file":"cost-forecast/error-handling.md","pattern":"System reconnaissance","snippet":"| `InvalidForecastRequestBody` | Request body has invalid JSON structure | Check JSON syntax — verif","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"blocker:cost-forecast/error-handling.md:22:system-reconnaissance","file":"cost-forecast/error-handling.md","pattern":"System reconnaissance","snippet":"| `DontContainsValidTimeRangeWhileContainsPeriod` | `timePeriod` is present but `from` or `to` is in","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"blocker:cost-forecast/error-handling.md:23:system-reconnaissance","file":"cost-forecast/error-handling.md","pattern":"System reconnaissance","snippet":"| `DontContainsValidTimeRangeWhileMonthlyAndIncludeCost` | Monthly granularity with `includeActualCo","category":"blocker","line_end":23,"severity":"low","line_start":23},{"id":"blocker:cost-forecast/error-handling.md:31:system-reconnaissance","file":"cost-forecast/error-handling.md","pattern":"System reconnaissance","snippet":"| \"Forecast is unavailable for the specified time period\" | Valid response with null/empty rows | No","category":"blocker","line_end":31,"severity":"low","line_start":31},{"id":"filesystem:cost-forecast/examples.md:3:path-traversal-sequence","file":"cost-forecast/examples.md","pattern":"Path traversal sequence","snippet":"Common forecast patterns with request bodies. Use the [SKILL.md workflow](../SKILL.md) to construct ","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"blocker:cost-forecast/guardrails.md:11:system-reconnaissance","file":"cost-forecast/guardrails.md","pattern":"System reconnaissance","snippet":"| Both dates must be valid | When `timePeriod` is present, both `from` and `to` must be valid parsea","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:cost-forecast/guardrails.md:12:system-reconnaissance","file":"cost-forecast/guardrails.md","pattern":"System reconnaissance","snippet":"| Monthly + includeActualCost | Monthly granularity with `includeActualCost=true` requires an explic","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:cost-forecast/guardrails.md:68:system-reconnaissance","file":"cost-forecast/guardrails.md","pattern":"System reconnaissance","snippet":"> ⚠️ **Warning:** This is **not an error** — it is a valid response indicating the forecast model ca","category":"blocker","line_end":68,"severity":"low","line_start":68},{"id":"blocker:cost-forecast/request-body-schema.md:111:system-reconnaissance","file":"cost-forecast/request-body-schema.md","pattern":"System reconnaissance","snippet":"| `to` date | Must be in the future | Can be any valid past/present date |","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"external_commands:cost-forecast/workflow.md:81:ruby-shell-backtick-execution","file":"cost-forecast/workflow.md","pattern":"Ruby/shell backtick execution","snippet":"--url \"/subscriptions/<subscription-id>/providers/Microsoft.CostManagement/forecast?api-version=2023","category":"external_commands","line_end":82,"severity":"medium","line_start":81},{"id":"external_commands:cost-forecast/workflow.md:77:powershell-invocation","file":"cost-forecast/workflow.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":77,"severity":"high","line_start":77},{"id":"filesystem:cost-forecast/workflow.md:5:path-traversal-sequence","file":"cost-forecast/workflow.md","pattern":"Path traversal sequence","snippet":"> ⚠️ **Warning:** If the user wants **historical** cost data, use the [Cost Query Workflow](../cost-","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:cost-forecast/workflow.md:21:path-traversal-sequence","file":"cost-forecast/workflow.md","pattern":"Path traversal sequence","snippet":"Use the same scope patterns from the Scope Reference table in the main [SKILL.md](../SKILL.md#scope-","category":"filesystem","line_end":21,"severity":"high","line_start":21},{"id":"filesystem:cost-forecast/workflow.md:44:path-traversal-sequence","file":"cost-forecast/workflow.md","pattern":"Path traversal sequence","snippet":"> ⚠️ **Warning:** Grouping is **NOT supported** for forecast. Suggest using the [Cost Query Workflow","category":"filesystem","line_end":44,"severity":"high","line_start":44},{"id":"filesystem:cost-forecast/workflow.md:93:path-traversal-sequence","file":"cost-forecast/workflow.md","pattern":"Path traversal sequence","snippet":"> 💡 **Tip:** \"Forecast is unavailable for the specified time period\" is not an error — it means the","category":"filesystem","line_end":93,"severity":"high","line_start":93},{"id":"blocker:cost-forecast/workflow.md:115:system-reconnaissance","file":"cost-forecast/workflow.md","pattern":"System reconnaissance","snippet":"| 400 | Invalid dependency | Set `includeActualCost: true` when using `includeFreshPartialCost`. |","category":"blocker","line_end":115,"severity":"low","line_start":115},{"id":"external_commands:cost-optimization/auth-best-practices.md:16:powershell-invocation","file":"cost-optimization/auth-best-practices.md","pattern":"PowerShell invocation","snippet":"| **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials","category":"external_commands","line_end":16,"severity":"high","line_start":16},{"id":"external_commands:cost-optimization/auth-best-practices.md:81:powershell-invocation","file":"cost-optimization/auth-best-practices.md","pattern":"PowerShell invocation","snippet":"3. **Azure PowerShell** — `Connect-AzAccount`","category":"external_commands","line_end":81,"severity":"high","line_start":81},{"id":"external_commands:cost-optimization/auth-best-practices.md:87:powershell-invocation","file":"cost-optimization/auth-best-practices.md","pattern":"PowerShell invocation","snippet":"// Local development only — uses CLI/PowerShell/VS Code credentials","category":"external_commands","line_end":87,"severity":"high","line_start":87},{"id":"env_access:cost-optimization/auth-best-practices.md:43:environment-variable-access-dot-notation","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"const credential = process.env.NODE_ENV === \"development\"","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:cost-optimization/auth-best-practices.md:101:environment-variable-access-dot-notation","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"if (process.env.NODE_ENV === \"development\") {","category":"env_access","line_end":101,"severity":"low","line_start":101},{"id":"env_access:cost-optimization/auth-best-practices.md:104:environment-variable-access-dot-notation","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"return process.env.AZURE_CLIENT_ID","category":"env_access","line_end":104,"severity":"low","line_start":104},{"id":"env_access:cost-optimization/auth-best-practices.md:105:environment-variable-access-dot-notation","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable access (dot notation)","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:cost-optimization/auth-best-practices.md:43:environment-variable-object","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable object","snippet":"const credential = process.env.NODE_ENV === \"development\"","category":"env_access","line_end":43,"severity":"low","line_start":43},{"id":"env_access:cost-optimization/auth-best-practices.md:101:environment-variable-object","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable object","snippet":"if (process.env.NODE_ENV === \"development\") {","category":"env_access","line_end":101,"severity":"low","line_start":101},{"id":"env_access:cost-optimization/auth-best-practices.md:104:environment-variable-object","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable object","snippet":"return process.env.AZURE_CLIENT_ID","category":"env_access","line_end":104,"severity":"low","line_start":104},{"id":"env_access:cost-optimization/auth-best-practices.md:105:environment-variable-object","file":"cost-optimization/auth-best-practices.md","pattern":"Environment variable object","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"env_access","line_end":105,"severity":"low","line_start":105},{"id":"env_access:cost-optimization/auth-best-practices.md:57:python-getenv-function","file":"cost-optimization/auth-best-practices.md","pattern":"Python getenv function","snippet":"if os.getenv(\"AZURE_FUNCTIONS_ENVIRONMENT\") == \"Development\"","category":"env_access","line_end":57,"severity":"low","line_start":57},{"id":"env_access:cost-optimization/auth-best-practices.md:57:getenv-function-call","file":"cost-optimization/auth-best-practices.md","pattern":"getenv function call","snippet":"if os.getenv(\"AZURE_FUNCTIONS_ENVIRONMENT\") == \"Development\"","category":"env_access","line_end":57,"severity":"low","line_start":57},{"id":"env_access:cost-optimization/auth-best-practices.md:69:getenv-function-call","file":"cost-optimization/auth-best-practices.md","pattern":"getenv function call","snippet":"var credential = \"Development\".equals(System.getenv(\"AZURE_FUNCTIONS_ENVIRONMENT\"))","category":"env_access","line_end":69,"severity":"low","line_start":69},{"id":"env_access:cost-optimization/auth-best-practices.md:104:azure-credential-environment-variables","file":"cost-optimization/auth-best-practices.md","pattern":"Azure credential environment variables","snippet":"return process.env.AZURE_CLIENT_ID","category":"env_access","line_end":104,"severity":"high","line_start":104},{"id":"env_access:cost-optimization/auth-best-practices.md:105:azure-credential-environment-variables","file":"cost-optimization/auth-best-practices.md","pattern":"Azure credential environment variables","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"env_access","line_end":105,"severity":"high","line_start":105},{"id":"sensitive:cost-optimization/auth-best-practices.md:43:environment-file-access","file":"cost-optimization/auth-best-practices.md","pattern":"Environment file access","snippet":"const credential = process.env.NODE_ENV === \"development\"","category":"sensitive","line_end":43,"severity":"high","line_start":43},{"id":"sensitive:cost-optimization/auth-best-practices.md:101:environment-file-access","file":"cost-optimization/auth-best-practices.md","pattern":"Environment file access","snippet":"if (process.env.NODE_ENV === \"development\") {","category":"sensitive","line_end":101,"severity":"high","line_start":101},{"id":"sensitive:cost-optimization/auth-best-practices.md:104:environment-file-access","file":"cost-optimization/auth-best-practices.md","pattern":"Environment file access","snippet":"return process.env.AZURE_CLIENT_ID","category":"sensitive","line_end":104,"severity":"high","line_start":104},{"id":"sensitive:cost-optimization/auth-best-practices.md:105:environment-file-access","file":"cost-optimization/auth-best-practices.md","pattern":"Environment file access","snippet":"? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID)  // user-assigned","category":"sensitive","line_end":105,"severity":"high","line_start":105},{"id":"network:cost-optimization/azure-aks-anomalies.md:13:hardcoded-url","file":"cost-optimization/azure-aks-anomalies.md","pattern":"Hardcoded URL","snippet":"--url \"https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"blocker:cost-optimization/azure-aks-anomalies.md:7:system-reconnaissance","file":"cost-optimization/azure-aks-anomalies.md","pattern":"System reconnaissance","snippet":"Ask the user: \"When did you notice the spike? (e.g., 'last Tuesday', 'between 2 AM and 4 AM yesterda","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"external_commands:cost-optimization/azure-quick-review.md:25:powershell-invocation","file":"cost-optimization/azure-quick-review.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":25,"severity":"high","line_start":25},{"id":"external_commands:cost-optimization/report-template.md:47:ruby-shell-backtick-execution","file":"cost-optimization/report-template.md","pattern":"Ruby/shell backtick execution","snippet":"- Cost Query Results: `output/cost-query-result<timestamp>.json`","category":"external_commands","line_end":49,"severity":"medium","line_start":47},{"id":"external_commands:cost-optimization/report-template.md:67:powershell-invocation","file":"cost-optimization/report-template.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":67,"severity":"high","line_start":67},{"id":"network:cost-optimization/report-template.md:56:hardcoded-url","file":"cost-optimization/report-template.md","pattern":"Hardcoded URL","snippet":"https://portal.azure.com/#@<TENANT_ID>/resource/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESO","category":"network","line_end":56,"severity":"low","line_start":56},{"id":"filesystem:cost-optimization/sdk/azure-resource-manager-redis-dotnet.md:13:path-traversal-sequence","file":"cost-optimization/sdk/azure-resource-manager-redis-dotnet.md","pattern":"Path traversal sequence","snippet":"> **Auth:** `DefaultAzureCredential` is for local development. See [auth-best-practices.md](../auth-","category":"filesystem","line_end":13,"severity":"high","line_start":13},{"id":"filesystem:cost-optimization/sdk/azure-resource-manager-redis-dotnet.md:24:path-traversal-sequence","file":"cost-optimization/sdk/azure-resource-manager-redis-dotnet.md","pattern":"Path traversal sequence","snippet":"- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCrede","category":"filesystem","line_end":24,"severity":"high","line_start":24},{"id":"external_commands:cost-optimization/workflow.md:186:ruby-shell-backtick-execution","file":"cost-optimization/workflow.md","pattern":"Ruby/shell backtick execution","snippet":"--resource \"<RESOURCE_ID>\" `","category":"external_commands","line_end":187,"severity":"medium","line_start":186},{"id":"external_commands:cost-optimization/workflow.md:188:ruby-shell-backtick-execution","file":"cost-optimization/workflow.md","pattern":"Ruby/shell backtick execution","snippet":"--interval PT1H `","category":"external_commands","line_end":189,"severity":"medium","line_start":188},{"id":"external_commands:cost-optimization/workflow.md:190:ruby-shell-backtick-execution","file":"cost-optimization/workflow.md","pattern":"Ruby/shell backtick execution","snippet":"--start-time $startTime `","category":"external_commands","line_end":192,"severity":"medium","line_start":190},{"id":"external_commands:cost-optimization/workflow.md:20:powershell-invocation","file":"cost-optimization/workflow.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":20,"severity":"high","line_start":20},{"id":"external_commands:cost-optimization/workflow.md:120:powershell-invocation","file":"cost-optimization/workflow.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":120,"severity":"high","line_start":120},{"id":"external_commands:cost-optimization/workflow.md:180:powershell-invocation","file":"cost-optimization/workflow.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":180,"severity":"high","line_start":180},{"id":"network:cost-optimization/workflow.md:158:python-http-libraries","file":"cost-optimization/workflow.md","pattern":"Python HTTP libraries","snippet":"**Execute and save results to `output/cost-query-result<timestamp>.json`.** Always include the `--he","category":"network","line_end":158,"severity":"low","line_start":158},{"id":"filesystem:cost-optimization/workflow.md:5:path-traversal-sequence","file":"cost-optimization/workflow.md","pattern":"Path traversal sequence","snippet":"> **Important:** Always present the total bill and cost breakdown (from the [Cost Query Workflow](..","category":"filesystem","line_end":5,"severity":"high","line_start":5},{"id":"filesystem:cost-optimization/workflow.md:127:path-traversal-sequence","file":"cost-optimization/workflow.md","pattern":"Path traversal sequence","snippet":"Get actual cost data from Azure Cost Management API (last 30 days). Use the [Cost Query Workflow](..","category":"filesystem","line_end":127,"severity":"high","line_start":127},{"id":"filesystem:cost-optimization/workflow.md:160:path-traversal-sequence","file":"cost-optimization/workflow.md","pattern":"Path traversal sequence","snippet":"> 💡 **Tip:** Also run a cost-by-service query (grouping by `ServiceName`) to present the total bill","category":"filesystem","line_end":160,"severity":"high","line_start":160},{"id":"blocker:cost-query/dimensions-by-scope.md:64:system-reconnaissance","file":"cost-query/dimensions-by-scope.md","pattern":"System reconnaissance","snippet":"Available dimensions vary by agreement type. Only dimensions listed for your agreement type are vali","category":"blocker","line_end":64,"severity":"low","line_start":64},{"id":"blocker:cost-query/dimensions-by-scope.md:180:system-reconnaissance","file":"cost-query/dimensions-by-scope.md","pattern":"System reconnaissance","snippet":"| `AgreementType` | The agreement type (`EA`, `MCA`, `MOSP`). | Determines valid dimension set. |","category":"blocker","line_end":180,"severity":"low","line_start":180},{"id":"blocker:cost-query/error-handling.md:9:system-reconnaissance","file":"cost-query/error-handling.md","pattern":"System reconnaissance","snippet":"| 400 | `BadRequest` | Invalid request body, unsupported dimension, date range exceeds limits, malfo","category":"blocker","line_end":9,"severity":"low","line_start":9},{"id":"blocker:cost-query/error-handling.md:21:system-reconnaissance","file":"cost-query/error-handling.md","pattern":"System reconnaissance","snippet":"| \"Dimension Z is not valid for scope\" | The requested dimension is not available for the current sc","category":"blocker","line_end":21,"severity":"low","line_start":21},{"id":"blocker:cost-query/error-handling.md:23:system-reconnaissance","file":"cost-query/error-handling.md","pattern":"System reconnaissance","snippet":"| Date range exceeds granularity limit | `Daily` range > 31 days or `Monthly`/`None` range > 12 mont","category":"blocker","line_end":23,"severity":"low","line_start":23},{"id":"blocker:cost-query/error-handling.md:26:system-reconnaissance","file":"cost-query/error-handling.md","pattern":"System reconnaissance","snippet":"| Invalid filter structure | `and`/`or` has fewer than 2 child expressions, or `not` has more than 1","category":"blocker","line_end":26,"severity":"low","line_start":26},{"id":"blocker:cost-query/error-handling.md:28:system-reconnaissance","file":"cost-query/error-handling.md","pattern":"System reconnaissance","snippet":"| `BillingSubscriptionNotFound` | The subscription ID in the scope URL is invalid or not associated ","category":"blocker","line_end":28,"severity":"low","line_start":28},{"id":"filesystem:cost-query/examples.md:3:path-traversal-sequence","file":"cost-query/examples.md","pattern":"Path traversal sequence","snippet":"Common query patterns with request bodies. Use the [SKILL.md workflow](../SKILL.md) to construct and","category":"filesystem","line_end":3,"severity":"high","line_start":3},{"id":"blocker:cost-query/guardrails.md:3:system-reconnaissance","file":"cost-query/guardrails.md","pattern":"System reconnaissance","snippet":"Detailed validation rules and guardrails for the Cost Management Query API. The system applies these","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:cost-query/guardrails.md:95:system-reconnaissance","file":"cost-query/guardrails.md","pattern":"System reconnaissance","snippet":"Dimensions must be valid for the intersection of the agreement type **and** scope type.","category":"blocker","line_end":95,"severity":"low","line_start":95},{"id":"blocker:cost-query/guardrails.md:105:system-reconnaissance","file":"cost-query/guardrails.md","pattern":"System reconnaissance","snippet":"| Dimension not valid for agreement type | `BillingSubscriptionNotFound` or dimension validation err","category":"blocker","line_end":105,"severity":"low","line_start":105},{"id":"blocker:cost-query/guardrails.md:106:system-reconnaissance","file":"cost-query/guardrails.md","pattern":"System reconnaissance","snippet":"| Dimension not valid for scope type | `BadRequest` with invalid dimension message. |","category":"blocker","line_end":106,"severity":"low","line_start":106},{"id":"external_commands:cost-query/workflow.md:79:ruby-shell-backtick-execution","file":"cost-query/workflow.md","pattern":"Ruby/shell backtick execution","snippet":"--url \"<scope>/providers/Microsoft.CostManagement/query?api-version=2023-11-01\" `","category":"external_commands","line_end":80,"severity":"medium","line_start":79},{"id":"external_commands:cost-query/workflow.md:111:ruby-shell-backtick-execution","file":"cost-query/workflow.md","pattern":"Ruby/shell backtick execution","snippet":"--url \"/subscriptions/<subscription-id>/providers/Microsoft.CostManagement/query?api-version=2023-11","category":"external_commands","line_end":112,"severity":"medium","line_start":111},{"id":"external_commands:cost-query/workflow.md:73:powershell-invocation","file":"cost-query/workflow.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":73,"severity":"high","line_start":73},{"id":"external_commands:cost-query/workflow.md:109:powershell-invocation","file":"cost-query/workflow.md","pattern":"PowerShell invocation","snippet":"```powershell","category":"external_commands","line_end":109,"severity":"high","line_start":109},{"id":"filesystem:cost-query/workflow.md:7:path-traversal-sequence","file":"cost-query/workflow.md","pattern":"Path traversal sequence","snippet":"Identify the Azure scope for the cost query from the Scope Reference table in the main [SKILL.md](..","category":"filesystem","line_end":7,"severity":"high","line_start":7},{"id":"blocker:cost-query/workflow.md:134:system-reconnaissance","file":"cost-query/workflow.md","pattern":"System reconnaissance","snippet":"| 400 | Invalid request body | Check schema, date ranges, and dimension compatibility. |","category":"blocker","line_end":134,"severity":"low","line_start":134},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Query API** | `POST {scope}/providers/Microsoft.CostManagement/query?api-version=2023-11-01` |","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **Forecast API** | `POST {scope}/providers/Microsoft.CostManagement/forecast?api-version=2023-11-0","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Subscription: `/subscriptions/<id>`","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Resource Group: `/subscriptions/<id>/resourceGroups/<name>`","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Management Group: `/providers/Microsoft.Management/managementGroups/<id>`","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Billing Account: `/providers/Microsoft.Billing/billingAccounts/<id>`","category":"external_commands","line_end":35,"severity":"medium","line_start":35}],"finding_verdicts":[{"id":"blocker:cost-forecast/error-handling.md:7:system-reconnaissance","reason":"This is a forecast API error table describing an invalid request. It performs no system discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/error-handling.md:10:system-reconnaissance","reason":"This row explains an Azure 404 response for an invalid scope. It does not enumerate local or remote systems.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/error-handling.md:20:system-reconnaissance","reason":"The text documents malformed forecast JSON and syntax validation. It contains no reconnaissance instruction.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/error-handling.md:22:system-reconnaissance","reason":"The row documents a forecast date-range validation error. It does not inspect system configuration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/error-handling.md:23:system-reconnaissance","reason":"The content explains a forecast request dependency involving monthly granularity. It is ordinary API validation guidance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/error-handling.md:31:system-reconnaissance","reason":"This is an interpretation of an empty forecast response. It does not probe the host or network.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:cost-forecast/examples.md:3:path-traversal-sequence","reason":"The sequence occurs only in a relative Markdown link to ../SKILL.md. No filesystem path is accepted or traversed at runtime.","verdict":"false_positive","confidence":1},{"id":"blocker:cost-forecast/guardrails.md:11:system-reconnaissance","reason":"This guardrail validates both forecast dates. It does not gather system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/guardrails.md:12:system-reconnaissance","reason":"This row documents a dependency between forecast options. It has no reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/guardrails.md:68:system-reconnaissance","reason":"The warning explains that unavailable forecast data is a valid response. It does not discover system details.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-forecast/request-body-schema.md:111:system-reconnaissance","reason":"This is a request-schema comparison for valid dates. It contains no system inspection.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-forecast/workflow.md:81:ruby-shell-backtick-execution","reason":"The backtick is a PowerShell line-continuation character in a documented az rest command. It is not Ruby command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-forecast/workflow.md:77:powershell-invocation","reason":"The match is a Markdown language label for a documented read-only forecast request. Arguments are fixed templates without command interpolation.","verdict":"false_positive","confidence":0.96},{"id":"filesystem:cost-forecast/workflow.md:5:path-traversal-sequence","reason":"The sequence belongs to a relative Markdown link between bundled workflow documents. It is not used for file access.","verdict":"false_positive","confidence":1},{"id":"filesystem:cost-forecast/workflow.md:21:path-traversal-sequence","reason":"The parent segment appears in a static Markdown link to the bundled SKILL.md file. No runtime traversal occurs.","verdict":"false_positive","confidence":1},{"id":"filesystem:cost-forecast/workflow.md:44:path-traversal-sequence","reason":"This is a documentation link to the neighboring cost-query workflow. It cannot traverse a user-selected path.","verdict":"false_positive","confidence":1},{"id":"filesystem:cost-forecast/workflow.md:93:path-traversal-sequence","reason":"The detected sequence is confined to a relative Markdown link. It is not executable filesystem logic.","verdict":"false_positive","confidence":1},{"id":"blocker:cost-forecast/workflow.md:115:system-reconnaissance","reason":"This error table explains a forecast option dependency. It performs no reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-optimization/auth-best-practices.md:16:powershell-invocation","reason":"The row names PowerShell as one credential source in DefaultAzureCredential. It does not invoke PowerShell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-optimization/auth-best-practices.md:81:powershell-invocation","reason":"Connect-AzAccount is a standard interactive Azure authentication option for local development. No untrusted command or argument is constructed.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:cost-optimization/auth-best-practices.md:87:powershell-invocation","reason":"This comment describes credential sources used by an Azure SDK example. It does not execute PowerShell.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:43:environment-variable-access-dot-notation","reason":"The example reads NODE_ENV only to choose a credential class. It does not access or transmit a secret.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:101:environment-variable-access-dot-notation","reason":"The documented condition reads NODE_ENV to distinguish local development. This is a non-sensitive environment selector.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:104:environment-variable-access-dot-notation","reason":"AZURE_CLIENT_ID identifies a managed identity and is not a credential secret. The value is passed only to the Azure identity SDK.","verdict":"false_positive","confidence":0.98},{"id":"env_access:cost-optimization/auth-best-practices.md:105:environment-variable-access-dot-notation","reason":"The sample passes AZURE_CLIENT_ID to ManagedIdentityCredential. It neither reads secret material nor sends data to an unrelated service.","verdict":"false_positive","confidence":0.98},{"id":"env_access:cost-optimization/auth-best-practices.md:43:environment-variable-object","reason":"process.env is used only to read the non-sensitive NODE_ENV mode in a documentation example. There is no environment enumeration.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:101:environment-variable-object","reason":"The code checks one named environment selector rather than reading the environment object broadly. No value is disclosed.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:104:environment-variable-object","reason":"The sample accesses one named managed-identity client identifier. It does not enumerate environment variables or expose credentials.","verdict":"false_positive","confidence":0.98},{"id":"env_access:cost-optimization/auth-best-practices.md:105:environment-variable-object","reason":"The environment object is used for a single AZURE_CLIENT_ID lookup in an SDK example. No secret collection occurs.","verdict":"false_positive","confidence":0.98},{"id":"env_access:cost-optimization/auth-best-practices.md:57:python-getenv-function","reason":"os.getenv reads AZURE_FUNCTIONS_ENVIRONMENT to detect local development. The sample does not access credentials.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:57:getenv-function-call","reason":"The getenv call retrieves only a documented runtime-mode variable. It is not used for secret discovery or exfiltration.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:69:getenv-function-call","reason":"The Java example reads AZURE_FUNCTIONS_ENVIRONMENT solely to choose local or managed identity authentication. No sensitive value is exposed.","verdict":"false_positive","confidence":0.99},{"id":"env_access:cost-optimization/auth-best-practices.md:104:azure-credential-environment-variables","reason":"AZURE_CLIENT_ID is a public identity identifier, not a client secret. The sample uses it only to select a managed identity.","verdict":"false_positive","confidence":0.98},{"id":"env_access:cost-optimization/auth-best-practices.md:105:azure-credential-environment-variables","reason":"The code passes a non-secret client identifier to ManagedIdentityCredential. It does not retrieve AZURE_CLIENT_SECRET or other credential material.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:cost-optimization/auth-best-practices.md:43:environment-file-access","reason":"The code reads process.env.NODE_ENV and never opens an environment file. The environment-file detector matched unrelated syntax.","verdict":"false_positive","confidence":1},{"id":"sensitive:cost-optimization/auth-best-practices.md:101:environment-file-access","reason":"This is an in-memory NODE_ENV check in a TypeScript example. No .env file or secret store is accessed.","verdict":"false_positive","confidence":1},{"id":"sensitive:cost-optimization/auth-best-practices.md:104:environment-file-access","reason":"The line reads a named process environment value, not an environment file. No file path is present.","verdict":"false_positive","confidence":1},{"id":"sensitive:cost-optimization/auth-best-practices.md:105:environment-file-access","reason":"The line passes AZURE_CLIENT_ID from process memory to an Azure SDK constructor. It does not open or parse a file.","verdict":"false_positive","confidence":1},{"id":"network:cost-optimization/azure-aks-anomalies.md:13:hardcoded-url","reason":"The URL is the official management.azure.com endpoint for the documented Cost Management API. It does not target an unrelated recipient.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-optimization/azure-aks-anomalies.md:7:system-reconnaissance","reason":"The instruction asks the user when a reported cost spike occurred. It does not inspect the system.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-optimization/azure-quick-review.md:25:powershell-invocation","reason":"The match is a Markdown code-fence label for a documented read-only azqr scan. Its scope arguments are explicit placeholders.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:cost-optimization/report-template.md:47:ruby-shell-backtick-execution","reason":"The backticks delimit an inline output filename in a Markdown report template. They do not execute a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:cost-optimization/report-template.md:67:powershell-invocation","reason":"The PowerShell block recursively force-deletes the relative temp directory. It does not verify that the directory belongs to this skill.","verdict":"confirmed","severity":"high","confidence":0.98},{"id":"network:cost-optimization/report-template.md:56:hardcoded-url","reason":"This is an official Azure Portal URL template containing placeholders. It is report navigation, not data exfiltration.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:cost-optimization/sdk/azure-resource-manager-redis-dotnet.md:13:path-traversal-sequence","reason":"The parent segment is part of a relative Markdown link to bundled authentication guidance. No runtime file lookup is performed.","verdict":"false_positive","confidence":1},{"id":"filesystem:cost-optimization/sdk/azure-resource-manager-redis-dotnet.md:24:path-traversal-sequence","reason":"The sequence occurs in a documentation link, not in path construction or filesystem access.","verdict":"false_positive","confidence":1},{"id":"external_commands:cost-optimization/workflow.md:186:ruby-shell-backtick-execution","reason":"The backtick continues a PowerShell az monitor metrics command onto the next line. It is not shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-optimization/workflow.md:188:ruby-shell-backtick-execution","reason":"This is another PowerShell line-continuation marker in the same read-only metrics query. No Ruby execution is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-optimization/workflow.md:190:ruby-shell-backtick-execution","reason":"The character continues a fixed Azure Monitor command. It does not evaluate embedded input as a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-optimization/workflow.md:20:powershell-invocation","reason":"The fenced block contains standard version, account, and extension checks. These are legitimate prerequisite checks without dynamic command construction.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:cost-optimization/workflow.md:120:powershell-invocation","reason":"The documented commands show the current account and list resources within an explicit Azure scope. They do not mutate resources.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:cost-optimization/workflow.md:180:powershell-invocation","reason":"The block performs a read-only Azure Monitor metrics query for rightsizing analysis. Placeholders are quoted and no shell evaluation is used.","verdict":"false_positive","confidence":0.97},{"id":"network:cost-optimization/workflow.md:158:python-http-libraries","reason":"The line is prose about saving a Cost Management result and contains no Python HTTP library call. The detector matched no network code.","verdict":"false_positive","confidence":1},{"id":"filesystem:cost-optimization/workflow.md:5:path-traversal-sequence","reason":"The parent segment occurs in a relative Markdown link to the bundled query workflow. It is not a runtime path.","verdict":"false_positive","confidence":1},{"id":"filesystem:cost-optimization/workflow.md:127:path-traversal-sequence","reason":"This is a static cross-reference to the neighboring query workflow. No filesystem traversal is attempted.","verdict":"false_positive","confidence":1},{"id":"filesystem:cost-optimization/workflow.md:160:path-traversal-sequence","reason":"The sequence appears only in a relative link to a bundled examples file. It cannot access user-controlled paths.","verdict":"false_positive","confidence":1},{"id":"blocker:cost-query/dimensions-by-scope.md:64:system-reconnaissance","reason":"This sentence explains that Azure dimensions vary by billing agreement. It does not discover system characteristics.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/dimensions-by-scope.md:180:system-reconnaissance","reason":"The row defines the AgreementType cost dimension. It is API reference material, not reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/error-handling.md:9:system-reconnaissance","reason":"The content lists causes for an Azure BadRequest response. It does not inspect a system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/error-handling.md:21:system-reconnaissance","reason":"This troubleshooting row explains an invalid query dimension. It contains no discovery command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/error-handling.md:23:system-reconnaissance","reason":"The line documents Azure date-range limits. It does not gather host, account, or network details.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/error-handling.md:26:system-reconnaissance","reason":"This is request filter validation guidance. It has no reconnaissance behavior.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/error-handling.md:28:system-reconnaissance","reason":"The row explains a subscription-scope API error. It does not enumerate subscriptions or probe access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:cost-query/examples.md:3:path-traversal-sequence","reason":"The sequence is in a relative Markdown link to ../SKILL.md. It is not consumed by filesystem code.","verdict":"false_positive","confidence":1},{"id":"blocker:cost-query/guardrails.md:3:system-reconnaissance","reason":"The phrase describes Azure Cost Management validation rules. It does not instruct the agent to inspect its environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/guardrails.md:95:system-reconnaissance","reason":"This API guardrail requires a dimension valid for the agreement and scope. It is not system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/guardrails.md:105:system-reconnaissance","reason":"The row maps an invalid agreement dimension to expected Azure errors. It performs no discovery.","verdict":"false_positive","confidence":0.99},{"id":"blocker:cost-query/guardrails.md:106:system-reconnaissance","reason":"The row documents the error for a dimension invalid at the selected scope. It contains no reconnaissance action.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-query/workflow.md:79:ruby-shell-backtick-execution","reason":"The backtick is PowerShell line continuation in a fixed az rest query. It is not Ruby or shell command substitution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-query/workflow.md:111:ruby-shell-backtick-execution","reason":"The detected character continues a documented PowerShell command. No string is evaluated as executable code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:cost-query/workflow.md:73:powershell-invocation","reason":"This fenced example creates a local request file and performs a read-only cost query. It uses fixed arguments and quoted placeholders.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:cost-query/workflow.md:109:powershell-invocation","reason":"The PowerShell example calls the official Cost Management query endpoint. It is read-only and does not construct commands from untrusted text.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:cost-query/workflow.md:7:path-traversal-sequence","reason":"The parent segment is part of a static link to the bundled SKILL.md reference. It does not access an arbitrary file.","verdict":"false_positive","confidence":1},{"id":"blocker:cost-query/workflow.md:134:system-reconnaissance","reason":"The row provides remediation for an invalid Azure request body. It does not perform system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Backticks format a Cost Management API route as inline Markdown. No command execution syntax is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"This is inline Markdown formatting around the forecast API route. It cannot execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"Backticks format a subscription scope example. The line contains no command interpreter or substitution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The matched text is an inline resource-group scope template. It is documentation, not executable shell syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The backticks delimit a management-group route in Markdown. No command is run.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The line is a formatted billing-account scope example. It contains no executable backtick expression.","verdict":"false_positive","confidence":1}],"semantic_findings":[{"title":"Unqualified Resource Deletion Recommendation","severity":"high","locations":[{"file":"cost-optimization/report-template.md","line_end":24,"line_start":23}],"confidence":0.95,"description":"The report template labels azqr-identified resources as immediately deletable. This can encourage destructive changes without dependency validation or explicit approval.","confidence_reasoning":"The template explicitly places azqr results under resources that can be deleted immediately. No validation or approval condition appears in that section."},{"title":"Azure Budget Creation Without Approval Checkpoint","severity":"medium","locations":[{"file":"cost-optimization/azure-aks-anomalies.md","line_end":77,"line_start":65}],"confidence":0.92,"description":"The anomaly workflow supplies a budget creation command with notification recipients but no explicit confirmation step. An investigation can therefore modify subscription state.","confidence_reasoning":"The cited section directly provides az consumption budget create after diagnostic steps. It does not require confirmation before the state-changing command."}],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"1bc522b995b8abd42b189cc3478031d52d9230ab41dde0e19a5db39832c85abc","subject_tree_hash":"af0a3c4652dfe6d32e299703d9ab4033dbd107d5be596742fdc62af9aa32d289","subject_plugin_path":"skills/microsoft/azure-cost","audit_payload_hash":"8c64e2e55c4e0f776fac31ce1f7c3626","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"1bc522b995b8abd42b189cc3478031d52d9230ab41dde0e19a5db39832c85abc","treeHash":"af0a3c4652dfe6d32e299703d9ab4033dbd107d5be596742fdc62af9aa32d289","pluginPath":"skills/microsoft/azure-cost","auditPayloadHash":"8c64e2e55c4e0f776fac31ce1f7c3626"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/microsoft-azure-cost/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}