{"data":{"skill":{"slug":"microsoft-azure-upgrade","name":"azure-upgrade","icon":"📦","repo":"https://github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/azure-upgrade/","status":"approved","author":"microsoft","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"11a29d58-c845-41ab-9867-2ada7da87c9c","skill_id":"13237b37-fe34-44f6-8dfc-3bad91660935","version":2,"content_hash":"9b24cafd79dfcdf3f9e82af0d28fd991","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static command-execution findings are mostly true in context: this skill is documentation that instructs an AI agent to generate and run Azure CLI, curl, and deployment commands. I found no prompt-injection attempt or confirmed malicious exfiltration, but the skill can create, modify, deploy, download packages from, and delete Azure resources, so it should not be published without stronger execution safeguards.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":57,"line_start":56},{"file":"references/services/functions/automation.md","line_end":20,"line_start":10},{"file":"references/services/functions/automation.md","line_end":238,"line_start":231},{"file":"references/services/functions/automation.md","line_end":332,"line_start":322},{"file":"references/services/functions/automation.md","line_end":407,"line_start":402},{"file":"references/services/functions/automation.md","line_end":420,"line_start":415}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"references/services/functions/automation.md","line_end":358,"line_start":352},{"file":"references/services/functions/automation.md","line_end":375,"line_start":373},{"file":"references/services/functions/consumption-to-flex.md","line_end":141,"line_start":139}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"references/workflow-details.md","line_end":19,"line_start":17},{"file":"references/services/functions/assessment.md","line_end":28,"line_start":22},{"file":"references/services/functions/automation.md","line_end":222,"line_start":220}]}],"critical_findings":[],"high_findings":[{"title":"Agent-Guided Azure Resource Modification and Deletion","locations":[{"file":"references/services/functions/automation.md","line_end":238,"line_start":231},{"file":"references/services/functions/automation.md","line_end":332,"line_start":322},{"file":"references/services/functions/automation.md","line_end":407,"line_start":402},{"file":"references/services/functions/automation.md","line_end":420,"line_start":415}],"confidence":0.91,"description":"The skill guides execution of Azure CLI commands that create a new function app, deploy code, restart apps, and delete function apps. The documents include confirmation language, but marketplace use would still expose users to high-impact cloud changes if an agent executes the steps with broad Azure permissions.","confidence_reasoning":"The referenced lines contain concrete Azure CLI commands for migration, deployment, restart, and deletion. The intent is legitimate Azure upgrade automation, but the operational impact is clearly high."},{"title":"Sensitive Configuration and Package Retrieval","locations":[{"file":"references/services/functions/automation.md","line_end":111,"line_start":109},{"file":"references/services/functions/automation.md","line_end":171,"line_start":151},{"file":"references/services/functions/automation.md","line_end":222,"line_start":212}],"confidence":0.88,"description":"The automation guide collects app settings, reads AzureWebJobsStorage, lists managed identity role assignments, and downloads a deployment package using a storage connection string. These steps can expose secrets or proprietary application code in the workspace or command output.","confidence_reasoning":"The commands directly retrieve app settings, identity data, and deployment packages. This is expected for migration work, but it creates real exposure risk if logs or files are mishandled."}],"medium_findings":[{"title":"Network Calls to User Workload Endpoints","locations":[{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"references/services/functions/automation.md","line_end":358,"line_start":352},{"file":"references/services/functions/automation.md","line_end":375,"line_start":371},{"file":"references/services/functions/consumption-to-flex.md","line_end":141,"line_start":139}],"confidence":0.82,"description":"The skill instructs the agent to call the default Azure Functions hostname and HTTP trigger endpoints with curl. This is a normal validation step, but it can contact production endpoints and may trigger application behavior.","confidence_reasoning":"The curl commands and validation step are explicit. The risk depends on the target app behavior, so this is moderate rather than inherently malicious."},{"title":"Local Workspace File Creation for Upgrade Artifacts","locations":[{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"references/workflow-details.md","line_end":19,"line_start":17},{"file":"references/services/functions/assessment.md","line_end":28,"line_start":22},{"file":"references/services/functions/automation.md","line_end":222,"line_start":220}],"confidence":0.78,"description":"The skill requires creating status and assessment files in the workspace and can download a deployment package. This is useful for migration tracking, but it may persist sensitive configuration or application artifacts locally.","confidence_reasoning":"The files and downloaded package are specifically named. The sensitivity depends on what values the agent writes into reports or package files."}],"low_findings":[{"title":"Static Weak-Crypto and Backtick Hits Are Markdown False Positives","locations":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"references/global-rules.md","line_end":39,"line_start":26},{"file":"references/workflow-details.md","line_end":13,"line_start":9},{"file":"references/services/functions/assessment.md","line_end":117,"line_start":30}],"confidence":0.86,"description":"Many weak cryptography and Ruby backtick findings map to Markdown emphasis, diagrams, inline code, Azure SKU names, or shell examples. I found no executable Ruby code, hidden cryptographic implementation, or prompt-injection instruction in the reviewed files.","confidence_reasoning":"The lines are documentation constructs or code-fenced templates, not executable skill code. The broader command examples remain risky, but these specific pattern classes are false positives."},{"title":"Hardcoded Documentation URLs Are Benign References","locations":[{"file":"references/services/functions/automation.md","line_end":6,"line_start":6},{"file":"references/services/functions/automation.md","line_end":318,"line_start":317},{"file":"references/services/functions/consumption-to-flex.md","line_end":227,"line_start":223}],"confidence":0.84,"description":"The hardcoded URLs point to Microsoft Learn and Azure sample documentation. I did not find evidence that the skill sends user data or secrets to those URLs.","confidence_reasoning":"The URLs are cited as documentation links, not request targets for collected data. Network activity in the skill comes from Azure CLI and curl validation commands instead."}],"dangerous_patterns":[{"title":"Cloud Command Execution Instructions","locations":[{"file":"references/services/functions/automation.md","line_end":20,"line_start":10},{"file":"references/services/functions/automation.md","line_end":238,"line_start":231},{"file":"references/services/functions/automation.md","line_end":332,"line_start":322},{"file":"references/services/functions/automation.md","line_end":420,"line_start":402}],"confidence":0.93,"description":"The skill contains runnable Azure CLI and Functions Core Tools commands for login, subscription selection, migration, deployment, validation, restart, and deletion.","confidence_reasoning":"The commands are explicit and intended to be run as part of the workflow. They are legitimate DevOps commands but dangerous without human approval and least-privilege Azure access."},{"title":"Secret-Bearing Configuration Collection","locations":[{"file":"references/services/functions/automation.md","line_end":111,"line_start":109},{"file":"references/services/functions/automation.md","line_end":222,"line_start":212}],"confidence":0.9,"description":"The automation flow reads app settings and a storage connection string, then uses the connection string to list and download deployment blobs.","confidence_reasoning":"The cited commands retrieve values that commonly include secrets and use them to access storage. No exfiltration target is shown, but accidental disclosure is a concrete risk."},{"title":"Production Endpoint Probing","locations":[{"file":"references/services/functions/automation.md","line_end":358,"line_start":352},{"file":"references/services/functions/automation.md","line_end":375,"line_start":371}],"confidence":0.8,"description":"The validation steps use curl against the upgraded app default host and function endpoint, which may invoke real production code paths.","confidence_reasoning":"The commands are direct endpoint probes. They are common smoke tests, but risk varies with the target function implementation."}],"files_scanned":6,"total_lines":955,"audit_model":"codex","audited_at":"2026-06-30T07:50:22.212+00:00","created_at":"2026-06-30T10:03:14.58256+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":2,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}