{"data":{"skill":{"slug":"sickn33-azure-keyvault-py","name":"azure-keyvault-py","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/azure-keyvault-py","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"0aa5b29e-4a8b-4c3d-9360-ae987ce4c33a","skill_id":"fd030f2b-3e94-4a93-ab51-14a52707d7cb","version":5,"content_hash":"v3:f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526:09f0cf7839aa4182225a90ad23df881d1f3b2578fddbe1cc3eee764cc60f7bb9:87d546913c027e393a716c6c5a20eea202505d3f0485d5cfb069a95a97cfa198:736b696c6c732f7369636b6e33332f617a7572652d6b65797661756c742d7079:6899ccec3d282bc8433c0cb51a7ea2c4","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 40 static findings are false positives caused by Markdown syntax, Azure endpoint placeholders, or SDK references. However, two examples print retrieved secret values and could expose credentials through logs.","remediation":[{"issue":"Synchronous and asynchronous examples print retrieved secret values.","severity":"high","suggestion":"Remove secret-value output. Print only non-sensitive metadata, and state that applications must never send secret values to logs."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":27,"line_start":15},{"file":"SKILL.md","line_end":31,"line_start":27},{"file":"SKILL.md","line_end":33,"line_start":31},{"file":"SKILL.md","line_end":39,"line_start":33},{"file":"SKILL.md","line_end":47,"line_start":39},{"file":"SKILL.md","line_end":51,"line_start":47},{"file":"SKILL.md","line_end":80,"line_start":51},{"file":"SKILL.md","line_end":86,"line_start":80},{"file":"SKILL.md","line_end":94,"line_start":86},{"file":"SKILL.md","line_end":98,"line_start":94},{"file":"SKILL.md","line_end":118,"line_start":98},{"file":"SKILL.md","line_end":122,"line_start":118},{"file":"SKILL.md","line_end":153,"line_start":122},{"file":"SKILL.md","line_end":159,"line_start":153},{"file":"SKILL.md","line_end":167,"line_start":159},{"file":"SKILL.md","line_end":171,"line_start":167},{"file":"SKILL.md","line_end":194,"line_start":171},{"file":"SKILL.md","line_end":200,"line_start":194},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":201,"line_start":201},{"file":"SKILL.md","line_end":202,"line_start":202},{"file":"SKILL.md","line_end":203,"line_start":203},{"file":"SKILL.md","line_end":221,"line_start":207},{"file":"SKILL.md","line_end":225,"line_start":221},{"file":"SKILL.md","line_end":236,"line_start":225}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":129,"line_start":129},{"file":"SKILL.md","line_end":164,"line_start":164}]}],"critical_findings":[],"high_findings":[{"title":"Secret Values Printed to Standard Output","locations":[{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":217,"line_start":215}],"confidence":0.99,"description":"The synchronous and asynchronous examples print retrieved secret values, which can expose credentials through terminal history, logs, or monitoring systems.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"Both examples directly pass the SDK secret value to print, creating a clear disclosure path when copied or executed."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":256,"audit_model":"codex","audited_at":"2026-07-23T20:34:24.785+00:00","created_at":"2026-07-26T05:22:42.947853+00:00","static_findings":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":27,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":31,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":33,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":39,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":47,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":51,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":80,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":86,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":94,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":98,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":118,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":122,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":153,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":159,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":167,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":171,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":194,"severity":"medium","line_start":171},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":200,"severity":"medium","line_start":194},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `SecretClient` | `azure-keyvault-secrets` | Store/retrieve secrets |","category":"external_commands","line_end":200,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `KeyClient` | `azure-keyvault-keys` | Manage cryptographic keys |","category":"external_commands","line_end":201,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `CryptographyClient` | `azure-keyvault-keys` | Encrypt/decrypt/sign/verify |","category":"external_commands","line_end":202,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `CertificateClient` | `azure-keyvault-certificates` | Manage certificates |","category":"external_commands","line_end":203,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":221,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":225,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":236,"severity":"medium","line_start":225},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"AZURE_KEYVAULT_URL=https://<vault-name>.vault.azure.net/","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"network:SKILL.md:44:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"vault_url = \"https://<vault-name>.vault.azure.net/\"","category":"network","line_end":44,"severity":"low","line_start":44},{"id":"network:SKILL.md:91:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"vault_url = \"https://<vault-name>.vault.azure.net/\"","category":"network","line_end":91,"severity":"low","line_start":91},{"id":"network:SKILL.md:129:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"\"https://<vault>.vault.azure.net/keys/<key-name>/<version>\",","category":"network","line_end":129,"severity":"low","line_start":129},{"id":"network:SKILL.md:164:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"vault_url = \"https://<vault-name>.vault.azure.net/\"","category":"network","line_end":164,"severity":"low","line_start":164},{"id":"sensitive:SKILL.md:41:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.secrets import SecretClient","category":"sensitive","line_end":41,"severity":"high","line_start":41},{"id":"sensitive:SKILL.md:88:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.keys import KeyClient","category":"sensitive","line_end":88,"severity":"high","line_start":88},{"id":"sensitive:SKILL.md:99:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.keys import KeyType","category":"sensitive","line_end":99,"severity":"high","line_start":99},{"id":"sensitive:SKILL.md:109:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"print(f\"Key type: {key.key_type}\")","category":"sensitive","line_end":109,"severity":"high","line_start":109},{"id":"sensitive:SKILL.md:123:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.keys.crypto import CryptographyClient, EncryptionAlgorithm","category":"sensitive","line_end":123,"severity":"high","line_start":123},{"id":"sensitive:SKILL.md:143:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.keys.crypto import SignatureAlgorithm","category":"sensitive","line_end":143,"severity":"high","line_start":143},{"id":"sensitive:SKILL.md:161:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.certificates import CertificateClient, CertificatePolicy","category":"sensitive","line_end":161,"severity":"high","line_start":161},{"id":"sensitive:SKILL.md:182:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.secrets import SecretClient","category":"sensitive","line_end":182,"severity":"high","line_start":182},{"id":"sensitive:SKILL.md:209:certificate-key-files","file":"SKILL.md","pattern":"Certificate/key files","snippet":"from azure.keyvault.secrets.aio import SecretClient","category":"sensitive","line_end":209,"severity":"high","line_start":209},{"id":"sensitive:SKILL.md:181:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"# Get certificate with private key (as secret)","category":"sensitive","line_end":181,"severity":"high","line_start":181}],"finding_verdicts":[{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"Line 15 opens a Markdown Bash fence containing fixed pip installation commands; no Ruby backtick or runtime execution exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 is only the closing Markdown fence for the installation example and cannot execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 opens a Markdown Bash fence for an environment variable example; it is documentation, not an execution primitive.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Line 33 is only a closing Markdown code fence and has no shell execution behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"Line 39 opens a Python documentation fence; the backticks are Markdown delimiters and do not invoke a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"Line 47 closes a Python example and contains no executable backtick expression.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Line 51 opens a Python example for SDK secret operations; the Markdown fence does not execute external commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Line 80 is the closing fence for a Python example and cannot execute a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"Line 86 opens a Python SDK example; it is a Markdown fence rather than Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"Line 94 only closes the documented Python setup example.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"Line 98 opens a Python example for Key Vault SDK calls and does not invoke any external process.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"Line 118 is only a closing Markdown fence with no execution semantics.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"Line 122 opens a Python cryptography example; the backticks only format documentation.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"Line 153 closes a Python code block and does not execute a process.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"Line 159 opens a Python certificate-client example; it is Markdown syntax only.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"Line 167 is only the closing Markdown fence for the certificate-client setup.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:171:ruby-shell-backtick-execution","reason":"Line 171 opens a Python certificate-operations example and contains no external command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:194:ruby-shell-backtick-execution","reason":"Line 194 only closes the documented Python example.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"Line 200 uses inline Markdown backticks around SDK and package names in a reference table; nothing is executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"Line 201 uses inline Markdown formatting for KeyClient and its package name, without an execution mechanism.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"Line 202 contains inline code labels in a Markdown table, not Ruby or shell commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"Line 203 formats CertificateClient and a package name with inline Markdown backticks and cannot execute them.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"Line 207 opens an asynchronous Python example; the backticks are a Markdown code fence.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"Line 221 closes the asynchronous Python example and has no command behavior.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","reason":"Line 225 opens a Python error-handling example; no external command invocation is present.","verdict":"false_positive","confidence":1},{"id":"network:SKILL.md:32:hardcoded-url","reason":"The value is a placeholder using Azure Key Vault's documented service domain, not a hardcoded live endpoint or untrusted destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:44:hardcoded-url","reason":"The URL contains a vault-name placeholder on the standard Azure domain and must be replaced by the user's own vault endpoint.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:91:hardcoded-url","reason":"The documented value is a nonfunctional vault-name placeholder on Azure's service domain, not a fixed external receiver.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:129:hardcoded-url","reason":"This is a fully placeholder-based Azure key identifier for a user's vault, key, and version, not an attacker-controlled destination.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:164:hardcoded-url","reason":"The certificate example uses the same standard Azure endpoint template and does not embed a real vault address.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:41:certificate-key-files","reason":"Line 41 imports SecretClient from the Azure SDK; it neither references certificate files nor exposes key material.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:88:certificate-key-files","reason":"Line 88 is an SDK class import for remote key management and contains no certificate or private-key file path.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:99:certificate-key-files","reason":"KeyType is an Azure SDK enum import, not a certificate file or private key.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:109:certificate-key-files","reason":"The example prints only the key type metadata and does not print key bytes, secrets, or file contents.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:123:certificate-key-files","reason":"Line 123 imports Azure cryptography client classes for remote operations and does not access a local key file.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:143:certificate-key-files","reason":"SignatureAlgorithm is an SDK enum import and contains no certificate or private-key data.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:161:certificate-key-files","reason":"Line 161 imports Azure certificate-management classes and does not reference a certificate file.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:182:certificate-key-files","reason":"Line 182 imports SecretClient for an authorized Key Vault retrieval example; it does not read or write a key file.","verdict":"false_positive","confidence":0.94},{"id":"sensitive:SKILL.md:209:certificate-key-files","reason":"Line 209 imports the asynchronous SecretClient and has no certificate-file or private-key-file operation.","verdict":"false_positive","confidence":1},{"id":"sensitive:SKILL.md:181:crypto-seed-private-key-mention","reason":"The comment accurately labels an authorized certificate retrieval workflow; no private key is logged, transmitted elsewhere, or written to disk.","verdict":"false_positive","confidence":0.9}],"semantic_findings":[{"title":"Secret Values Printed to Standard Output","severity":"high","locations":[{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":217,"line_start":215}],"confidence":0.99,"description":"The synchronous and asynchronous examples print retrieved secret values, which can expose credentials through terminal history, logs, or monitoring systems.","confidence_reasoning":"Both examples directly pass the SDK secret value to print, creating a clear disclosure path when copied or executed."}],"subject_marketplace_commit_sha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","subject_content_hash":"09f0cf7839aa4182225a90ad23df881d1f3b2578fddbe1cc3eee764cc60f7bb9","subject_tree_hash":"87d546913c027e393a716c6c5a20eea202505d3f0485d5cfb069a95a97cfa198","subject_plugin_path":"skills/sickn33/azure-keyvault-py","audit_payload_hash":"6899ccec3d282bc8433c0cb51a7ea2c4","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526","contentHash":"09f0cf7839aa4182225a90ad23df881d1f3b2578fddbe1cc3eee764cc60f7bb9","treeHash":"87d546913c027e393a716c6c5a20eea202505d3f0485d5cfb069a95a97cfa198","pluginPath":"skills/sickn33/azure-keyvault-py","auditPayloadHash":"6899ccec3d282bc8433c0cb51a7ea2c4"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-azure-keyvault-py/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}