Подтверждённые проблемы безопасности (7) требуют внимания.
Контекст установки
Исторические доказательства
Этот отчёт может не описывать артефакт, доступный для установки в настоящее время. Откройте текущую страницу Навыка для получения рекомендаций по установке.
Этот отчёт не блокирует и не разрешает манифест или ZIP.
Most static findings are false positives caused by Markdown backticks, Kubernetes field names, documentation URLs, and safety examples. Confirmed risks relate to Azure CLI or MCP actions against live cloud resources, AKS credential permissions, temporary export of cluster manifests, and RBAC grant guidance. No prompt injection attempt was found in the reviewed files.
Позиция отчета
Исторический отчет
Откройте историю аудита перед использованием этого отчета для установки.
Аттестация аудита
Не подлежит аттестации
Требуемая неизменяемая привязка не завершена.
Проверка человеком
Не проверено
Для этого отчета не зафиксирована проверка человеком.
Этот отчёт не заявляет о выполнении во время работы или в песочнице и не доказывает отсутствие побочных эффектов.
01
Цепочка доказательств
Проследите доказательства от привязки источника до контракта установки. Доступные доказательства подтверждают возможность проверки; они не являются гарантией безопасности.
The required permission includes listClusterUserCredential/action, which can retrieve AKS user credentials. This is sensitive even when needed for assessment.
--assignee $(az ad signed-in-user show --query id -o tsv) \
The bash example runs Azure CLI with shell substitution to query the signed-in user and role assignments. This is legitimate guidance, but it accesses tenant identity and cluster-scope RBAC data.
kubectl get deployment,statefulset,daemonset,job,cronjob -A -o yaml > /tmp/workloads.yaml
The fallback command exports cluster-wide workload YAML to /tmp. That file can expose workload metadata and should not be written to shared temporary paths without consent or redaction.
kubectl get pdb,storageclass -A -o yaml > /tmp/policies.yaml
The fallback command exports cluster policy YAML to /tmp. Cluster policy metadata can be sensitive and should use a user-approved restricted path or in-memory processing.
| `mcp_azure_mcp_aks` | AKS MCP entry point — call `discover` first, then use the assessment action
The MCP tool entry operates against AKS resources using subscription, resource group, and cluster identifiers. Live cluster access is legitimate but requires least privilege and user authorization.
Call the AKS MCP tool — this is the preferred path. Always call `discover` first to get the availabl
The workflow explicitly instructs the agent to call AKS MCP discovery and assessment actions. This can access live Azure and cluster metadata, so it is a real operational risk.
The code block calls mcp_azure_mcp_aks with subscription, resource group, and cluster parameters. That live assessment can access tenant resources and workload metadata.
| MCP tool call fails or times out | Invalid credentials or subscription context | Verify `az login`
The troubleshooting guidance tells the agent to verify az login and az account show. These commands read local Azure authentication state and subscription metadata.
| CLI | `az aks create`, `az aks show`, `kubectl get`, `kubectl describe` |
The quick reference lists az aks and kubectl commands the skill may use. These tools can read or modify cluster state, so execution must be authorized by the user.
- Do not ask the user to paste subscription IDs. Discover subscription and resource scope via MCP to
The rule tells the agent to use MCP or az account show/list to discover subscription scope. This reads cloud account metadata and must be handled carefully.
The MCP integration reference includes an az role assignment create command for the Azure Kubernetes Service Cluster User Role. If an agent ran it without explicit approval, it could grant cluster access.
The command is shown directly and requires Owner or User Access Administrator rights. It is legitimate documentation but materially changes Azure RBAC.
fix: "az aks update --enable-apiserver-vnet-integration --apiserver-subnet-id <subnet-id>"
The fix string is an az aks update command that changes cluster networking configuration. It is legitimate remediation guidance, but it is a live Azure mutation requiring explicit approval.
The line is part of an az aks enable-addons command that changes monitoring configuration. The reconnaissance label is imprecise, but the command is a real cluster change.
--assignee $(az ad signed-in-user show --query id -o tsv) \
The command reads Azure identity and role assignment data for the current user. It is expected for setup checks, but it is still cloud account reconnaissance and should require user authorization.
kubectl get pdb,storageclass -A -o yaml > /tmp/policies.yaml
The command collects cluster policy inventory across namespaces. The network-recon label is imprecise, but the cluster-wide inventory is sensitive operational metadata.
| MCP tool call fails or times out | Invalid credentials or subscription context | Verify `az login`
The line advises checking az login and az account show, which reads account context. The use is legitimate troubleshooting, but it still exposes cloud account metadata.
| MCP tool call fails or times out | Invalid credentials, subscription, or AKS context | Verify `az
The line advises checking az login and az account show, which reads cloud account context. It is legitimate troubleshooting, but still account metadata access.
04
Меры по устранению
В ходе этого аудита были зафиксированы рекомендуемые исправления. Их применение является ответственностью сопровождающего.
FIX-001
Высокий
The MCP integration reference includes an Azure RBAC role assignment command.
Do not auto-run role assignment commands. Present them as manual steps, require explicit approval, and use least-privilege scope.
FIX-002
Высокий
Live assessment requires sensitive AKS credential-related permissions.
Document why listClusterUserCredential/action is needed and offer offline manifest validation when users cannot grant that permission.
FIX-003
Средний
Azure CLI and MCP operations can read or change live AKS resources.
Require explicit user approval before live Azure actions, show the exact command or tool call, and prefer read-only operations when possible.
FIX-004
Средний
Fallback guidance writes cluster inventory files to /tmp.
Use a user-approved restricted workspace path or in-memory processing, and redact sensitive workload fields before saving.
05
Экспертные доказательства
Неизменяемая идентификация субъекта, метаданные сканера, отклонённые совпадения и доказательства на уровне источника.
Субъект артефакта
Коммит Marketplace
Недоступно
Хеш содержимого
Недоступно
Хеш дерева
Недоступно
Путь Skill
Недоступно
Хеш данных аудита
Недоступно
Метаданные анализа
Модель аудита: codex
Состояние анализа: Завершено
Область действия ограничена зафиксированными файлами, строками, методами и доказательствами. Выполнение во время работы или в песочнице не заявляется.