Static analysis flagged many external command, network, and high-risk keyword patterns. Manual review found no malware, credential access, exfiltration, or prompt injection, but the skill does guide Azure CLI usage and includes quota mutation commands that require operator caution.
The static external command findings are mostly false positives because the files document Azure CLI examples, not executable scripts. They still represent a real operational risk because the skill instructs users or agents to run az quota commands against Azure subscriptions.
The cited lines clearly show Azure CLI command guidance. The risk is operational rather than malicious because the commands are documented examples with placeholders.
The skill includes az quota update and az quota create examples. These commands can change requested quota limits in a real Azure subscription if run with sufficient permissions.
The commands are explicitly documented and their purpose is quota changes. The examples use placeholders, so this is not evidence of malicious account modification.
The network findings are hardcoded links to Microsoft Learn and the Azure Portal. No evidence found of hidden external endpoints, telemetry, or data exfiltration.
The URLs point to Azure Portal or Microsoft Learn documentation and are used as references. I found no code that sends user data to these URLs.
Static High-Risk Pattern Matches Are Documentation False Positives
The weak cryptography and PowerShell findings do not indicate dangerous behavior in context. The cited lines are metadata, command tables, ordinary text, or references to Azure CLI output fields.
Manual review of the cited locations showed no weak cryptographic primitive and no executable PowerShell invocation. The findings appear to be keyword collisions in Markdown.