スキル azure-cloud-migrate

📦

azure-cloud-migrate

Name: azure-cloud-migrate
Author: microsoft

v0.0.0-placeholder コンテンツリビジョン r1 高リスク 🔑 環境変数🌐 ネットワークアクセス📁 ファイルシステムへのアクセス⚙️ 外部コマンド⚡ スクリプトを含む

クラウドワークロードを Azure に移行

サービス、ランタイム、ID モデルが異なる場合、クラウド移行は困難です。このスキルは、サーバーレスワークロード向けに Azure の評価と移行ガイダンスを体系化します。

対応: Claude Codex Code(CC)

⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "azure-cloud-migrate" from https://skillstore.io/skills/microsoft-azure-cloud-migrate.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-cloud-migrate/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/microsoft-azure-cloud-migrate.md 署名済み manifest GET /api/skills/microsoft-azure-cloud-migrate/manifest 署名済み lockfile GET /api/skills/microsoft-azure-cloud-migrate/lockfile

テストする

「azure-cloud-migrate」を使用しています。 Assess a Lambda image-processing app that uses S3 events and Rekognition.

期待される結果:

関数インベントリ、サービスマッピング、トリガーマッピング、ID の推奨事項、移行の次のステップを含む対応準備レポート。

「azure-cloud-migrate」を使用しています。 Convert a Node.js Lambda handler to Azure Functions.

期待される結果:

Azure Functions v4 モデルを選択し、バインディングを推奨し、依存関係を更新し、テストタスクを記録する移行計画。

「azure-cloud-migrate」を使用しています。 Prepare handoff after code migration is complete.

期待される結果:

完了した移行作業を要約し、Azure 準備フェーズに必要なインフラストラクチャ要件を一覧化するステータス更新。

セキュリティ監査

高リスク

v6 • 2026/7/23 バージョン別レポートを開く

Most of the 400 presented findings are documentation false positives involving links, code fences, managed identity examples, and visible migration commands. Confirmed risks involve shared cloud keys, decoded secret transfer through CLI arguments, and local secret materialization. The 30 omitted static matches require manual review before publication. Static review was capped at 400/430 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

スキャンされたファイル

4,622

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (9)

高

references/services/container-apps/deployment-guide.md:82

System reconnaissance

> **Tip**: Prefer piping decoded secret values directly to `az keyvault secret set --value` to avoid

The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.

高

references/services/container-apps/deployment-guide.md:21-22

Kubernetes Secrets Exported Into Workspace

The guide exports deployments, services, ingress, ConfigMaps, and Secret objects to all-resources.yaml. Base64-encoded Kubernetes secrets can remain recoverable in the workspace.

The command explicitly includes Secret objects in a YAML export file. This directly materializes sensitive values during migration.

高

references/services/container-apps/deployment-guide.md:89-91 references/services/container-apps/deployment-guide.md:108-112 references/services/container-apps/cloudrun-deployment-guide.md:114-116 references/services/container-apps/cloudrun-deployment-guide.md:135-137

Decoded Secrets Passed Through CLI Arguments

Several examples pass decoded secrets to az keyvault secret set with --value. Process listings, command logging, terminal history, or shell history may expose them.

The cited examples retrieve decoded secret values and pass them as CLI arguments. The exposure risk is direct despite legitimate migration intent.

中

references/services/container-apps/cloudrun-deployment-guide.md:57

System reconnaissance

--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

中

references/services/container-apps/cloudrun-deployment-guide.md:68

System reconnaissance

--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

中

references/services/container-apps/cloudrun-deployment-guide.md:81

System reconnaissance

--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY" \

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

中

references/services/container-apps/cloudrun-deployment-guide.md:92

System reconnaissance

--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey `

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

中

references/services/container-apps/fargate-deployment-guide.md:114

System reconnaissance

aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> \

The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.

確認済みの9件をすべて表示

中

references/services/container-apps/fargate-deployment-guide.md:144

System reconnaissance

aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `

The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.

機能レビュー項目 (14)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

references/services/container-apps/spring-deployment-guide.md:103

Database connection strings

read -s -p "Enter database password: " DB_PASSWORD

The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.

高

references/services/container-apps/spring-deployment-guide.md:104

Database connection strings

echo -n "$DB_PASSWORD" > "$SECRET_FILE"

The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.

高

references/services/container-apps/cloudrun-deployment-guide.md:116

Shell command substitution

--value "$(gcloud secrets versions access latest --secret=<secret-id> --project="$GCP_PROJECT")"

The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.

高

references/services/container-apps/deployment-guide.md:91

Shell command substitution

az keyvault secret set --vault-name myapp-kv --name password --value "$(kubectl get secret mysecret

The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.

中

references/services/container-apps/fargate-deployment-guide.md:144-146

Ruby/shell backtick execution

aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `

The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.

中

references/services/container-apps/spring-deployment-guide.md:83-85

Ruby/shell backtick execution

--azure-file-account-name "$STORAGE_ACCOUNT" --azure-file-account-key "$STORAGE_KEY" `

The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.

中

references/services/container-apps/cloudrun-deployment-guide.md:55

Shell command substitution

LOG_KEY=$(az monitor log-analytics workspace get-shared-keys -g "$RG" -n "${RG}-logs" --query primar

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

中

references/services/container-apps/deployment-guide.md:64

Shell command substitution

LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group myapp-rg --workspace-n

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

中

references/services/container-apps/fargate-deployment-guide.md:112

Shell command substitution

secret_file="$(mktemp)"

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

中

references/services/container-apps/spring-deployment-guide.md:12

Shell command substitution

LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group spring-rg --workspace-

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

中

references/services/container-apps/spring-deployment-guide.md:69

Shell command substitution

STORAGE_KEY=$(az storage account keys list --account-name "$STORAGE_ACCOUNT" --resource-group spring

The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.

中

references/services/container-apps/spring-deployment-guide.md:101

Shell command substitution

SECRET_FILE=$(mktemp)

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

中

references/services/container-apps/fargate-deployment-guide.md:112

Temp file creation

secret_file="$(mktemp)"

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

中

references/services/container-apps/spring-deployment-guide.md:101

Temp file creation

SECRET_FILE=$(mktemp)

The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.

リスク要因

🔑 環境変数 (50)

🌐 ネットワークアクセス (23)

📁 ファイルシステムへのアクセス (7)

references/services/app-service/code-migration.md:91 references/services/container-apps/fargate-deployment-guide.md:112 references/services/container-apps/spring-deployment-guide.md:102 references/services/container-apps/spring-deployment-guide.md:101 references/services/functions/runtimes/javascript.md:8 references/services/functions/runtimes/javascript.md:93 references/services/functions/runtimes/python.md:9

⚙️ 外部コマンド (50)

⚡ スクリプトを含む (12)

検出されたパターン

System reconnaissance×7

監査者: codex 監査履歴を表示 →

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-cloud-migrate/security.svg)](https://skillstore.io/skills/microsoft-azure-cloud-migrate?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/microsoft-azure-cloud-migrate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-cloud-migrate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-cloud-migrate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

microsoft. (2026). azure-cloud-migrate security audit report (audit version 6) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6

BibTeX形式の引用

@techreport{microsoft-microsoft-azure-cloud-migrate-2026,
  author = {microsoft},
  title = {azure-cloud-migrate security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-cloud-migrate security audit report (audit version 6)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-cloud-migrate/audits/6"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-cloud-migrate:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Lambda 移行を評価

Azure 移行作業に着手する前に、関数、トリガー、依存関係、サービスマッピング、対応準備状況をレビューします。

サーバーレスコードを変換

選択したランタイムとプログラミングモデルに合わせて、Lambda ハンドラーを Azure Functions パターンに変換します。

Azure プラットフォーム要件を計画

移行後の Functions アプリに必要な ID、ストレージ、Event Grid、監視、Bicep 要件を特定します。

これらのプロンプトを試す

移行評価を開始

Assess this AWS Lambda folder for migration to Azure Functions. Identify functions, triggers, dependencies, service mappings, and migration readiness.

サービスとトリガーをマッピング

Compare this serverless workload with Azure Functions. Map each AWS service, trigger, environment setting, and monitoring component to an Azure equivalent.

移行計画を生成

Create a migration plan for these Lambda functions. Include target runtime, Azure Functions binding patterns, dependency changes, and validation tasks.

複雑な引き継ぎを計画

Plan migration for a serverless app using S3 events, DynamoDB, SQS, and CloudWatch. Recommend Azure services, identity, Bicep requirements, and deployment handoff steps.