監査履歴

Most of the 400 presented findings are documentation false positives involving links, code fences, managed identity examples, and visible migration commands. Confirmed risks involve shared cloud keys, decoded secret transfer through CLI arguments, and local secret materialization. The 30 omitted static matches require manual review before publication. Static review was capped at 400/430 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Most static findings are documentation false positives from Markdown links, code fences, Azure managed identity examples, and visible migration commands. Confirmed risks remain where the guides retrieve shared keys, export Kubernetes secrets, or pass decoded secret values through command-line arguments during migration.

Manual review found that the static findings are Markdown reference examples, table entries, placeholders, or Azure Functions code samples rather than executable skill logic. I found no evidence of prompt injection, credential exfiltration, arbitrary command execution, malicious networking, or path traversal intent in the cited files.

Manual review found that the static findings are Markdown reference examples, table entries, placeholders, or Azure Functions code samples rather than executable skill logic. I found no evidence of prompt injection, credential exfiltration, arbitrary command execution, malicious networking, or path traversal intent in the cited files.

Static analysis reported many command, credential, URL, and script indicators, but review found them in Markdown guidance and code examples. No prompt injection, credential exfiltration, hidden executable payload, or malicious intent was found. The skill has low operational risk because it guides file creation and uses Azure documentation tools during migration.

This is an official Microsoft skill for migrating AWS Lambda workloads to Azure Functions. Static findings are false positives: backtick usage is markdown code formatting, environment variable access is legitimate Azure authentication, network URLs point to Azure documentation, and the SAM detection refers to AWS Serverless Application Model, not Windows Security Accounts Manager. No malicious code detected.