{"data":{"skill":{"slug":"microsoft-azure-messaging","name":"azure-messaging","icon":"📦","repo":"https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-messaging/","status":"approved","author":"microsoft","authorVersion":"0.0.0-placeholder","skillstoreRevision":2},"audit":{"id":"662f97c0-48e5-4471-8009-081e25d57c7b","skill_id":"28b29b93-68db-4612-82fb-0200735c823b","version":5,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:bd8c9fd9ee96046c39340c78bf66615b344ac1c54300da2b09c834c8def5787b:00fa3f7470c48a2b3e8de82d95f47ea66a4c2b0479aace69777fd16b86c79d36:736b696c6c732f6d6963726f736f66742f617a7572652d6d6573736167696e67:a42af311d7027c19d3c195d3e09e3b0e","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All ten static findings are false positives caused by Markdown backticks around MCP tool names, operation names, and a path. No shell or Ruby execution is present in SKILL.md. The documented Azure MCP workflow can read cloud resource metadata and diagnostic logs, so users should apply least-privilege access.","remediation":[{"issue":"Azure MCP tools can access cloud resource metadata and diagnostic logs.","severity":"medium","suggestion":"Document required read-only Azure roles and require user confirmation before querying production resources or logs."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":57,"line_start":57}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Cloud Resource and Diagnostic Log Access","locations":[{"file":"SKILL.md","line_end":46,"line_start":35}],"confidence":0.98,"description":"The skill directs Azure MCP tools to list messaging resources, check service health, and query diagnostic logs using the user's cloud permissions. These read operations may expose subscription topology and operational data.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The MCP tool table and diagnosis workflow explicitly describe resource listing, health checks, and KQL log queries. The documented operations are read-oriented but require authorized Azure access."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":64,"audit_model":"codex","audited_at":"2026-07-23T18:53:33.899+00:00","created_at":"2026-07-25T23:06:34.18573+00:00","static_findings":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **MCP Tools** | `mcp_azure_mcp_eventhubs`, `mcp_azure_mcp_servicebus` |","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_eventhubs` | Namespace/hub ops | List namespaces, hubs, consumer groups |","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_servicebus` | Queue/topic ops | List namespaces, queues, topics, subscriptions |","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_monitor` | `logs_query` | Query diagnostic logs with KQL |","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_resourcehealth` | `get` | Check service health status |","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `mcp_azure_mcp_documentation` | Doc search | Search Microsoft Learn for troubleshooting docs |","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Check resource health** — Use `mcp_azure_mcp_resourcehealth` to verify the namespace is healthy","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Look up documentation** — Use `mcp_azure_mcp_documentation` to search Microsoft Learn for the e","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Connectivity, SDK, and auth troubleshooting guides are located in the azure-diagnostics skill under ","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Use `mcp_azure_mcp_documentation` to search Microsoft Learn for latest guidance.","category":"external_commands","line_end":57,"severity":"medium","line_start":57}],"finding_verdicts":[{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The backticks format two MCP tool names in a Markdown table. The line contains no Ruby expression, shell command, or execution mechanism.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"The backticks format the Event Hubs MCP tool name in a Markdown table. The surrounding text only describes supported namespace and hub operations.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The backticks format the Service Bus MCP tool name in a Markdown table. No shell syntax or executable code is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The backticks mark an MCP tool name and its logs_query operation as inline code. This is documentation for a structured tool call, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The backticks mark the resource health MCP tool and get operation as inline code. The line documents tool usage without invoking Ruby or a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The backticks format the documentation MCP tool name. The line describes a Microsoft Learn search capability and contains no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The backticks identify the structured MCP tool used for a resource health check. They are Markdown delimiters, not Ruby backtick operators.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The backticks format the documentation MCP tool name within a diagnostic workflow. No executable command or user-controlled shell input appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The backticks format a relative documentation path in prose. A path reference does not execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The backticks format the documentation MCP tool name in a reference bullet. The instruction describes a structured documentation search, not shell execution.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Cloud Resource and Diagnostic Log Access","severity":"medium","locations":[{"file":"SKILL.md","line_end":46,"line_start":35}],"confidence":0.98,"description":"The skill directs Azure MCP tools to list messaging resources, check service health, and query diagnostic logs using the user's cloud permissions. These read operations may expose subscription topology and operational data.","confidence_reasoning":"The MCP tool table and diagnosis workflow explicitly describe resource listing, health checks, and KQL log queries. The documented operations are read-oriented but require authorized Azure access."}],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"bd8c9fd9ee96046c39340c78bf66615b344ac1c54300da2b09c834c8def5787b","subject_tree_hash":"00fa3f7470c48a2b3e8de82d95f47ea66a4c2b0479aace69777fd16b86c79d36","subject_plugin_path":"skills/microsoft/azure-messaging","audit_payload_hash":"a42af311d7027c19d3c195d3e09e3b0e","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"bd8c9fd9ee96046c39340c78bf66615b344ac1c54300da2b09c834c8def5787b","treeHash":"00fa3f7470c48a2b3e8de82d95f47ea66a4c2b0479aace69777fd16b86c79d36","pluginPath":"skills/microsoft/azure-messaging","auditPayloadHash":"a42af311d7027c19d3c195d3e09e3b0e"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/microsoft-azure-messaging/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}