Versioned security assessment
Report ID: SA-DBE0E719
7/8/2026, 8:27:04 AM
azure-cloud-migrate security assessment v5
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- azure-cloud-migrate
- Version
- v5
- Maintainer
- microsoft
- Coverage
- 32 Files scanned · 4,622 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
9 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static findings are documentation false positives from Markdown links, code fences, Azure managed identity examples, and visible migration commands. Confirmed risks remain where the guides retrieve shared keys, export Kubernetes secrets, or pass decoded secret values through command-line arguments during migration.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
32 Files scanned · 4,622 Lines analyzed
23 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 12 evidence locations
Network access
May connect to external services.
Observed in 23 evidence locations
Filesystem access
May read or write local files.
Observed in 7 evidence locations
Env variables
May read values from the process environment.
Observed in 34 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 171 evidence locations
Capability review items (14)
High
Shell command substitution
--value "$(gcloud secrets versions access latest --secret=<secret-id> --project="$GCP_PROJECT")"
The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.
High
Shell command substitution
az keyvault secret set --vault-name myapp-kv --name password --value "$(kubectl get secret mysecret
The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.
High
Database connection strings
read -s -p "Enter database password: " DB_PASSWORD
The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.
High
Database connection strings
echo -n "$DB_PASSWORD" > "$SECRET_FILE"
The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.
Medium
Shell command substitution
LOG_KEY=$(az monitor log-analytics workspace get-shared-keys -g "$RG" -n "${RG}-logs" --query primar
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Shell command substitution
LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group myapp-rg --workspace-n
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Ruby/shell backtick execution
aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `
The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.
Medium
Shell command substitution
secret_file="$(mktemp)"
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Medium
Temp file creation
secret_file="$(mktemp)"
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Medium
Ruby/shell backtick execution
--azure-file-account-name "$STORAGE_ACCOUNT" --azure-file-account-key "$STORAGE_KEY" `
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
Medium
Shell command substitution
LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group spring-rg --workspace-
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Shell command substitution
STORAGE_KEY=$(az storage account keys list --account-name "$STORAGE_ACCOUNT" --resource-group spring
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Shell command substitution
SECRET_FILE=$(mktemp)
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Medium
Temp file creation
SECRET_FILE=$(mktemp)
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (9)
RISK-001 High
System reconnaissance
> **Tip**: Prefer piping decoded secret values directly to `az keyvault secret set --value` to avoid
The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.
RISK-002 High
Kubernetes Secrets Exported Into Workspace
The Kubernetes deployment guide creates an export directory and writes all resources, including Secret objects, to all-resources.yaml. Kubernetes Secret values are base64 encoded, not encrypted, so this can leave sensitive data in the workspace.
The command explicitly includes secret resources in a YAML export file. This is direct evidence of local secret materialization during assessment.
RISK-003 High
references/services/container-apps/deployment-guide.md:89-91references/services/container-apps/deployment-guide.md:108-112references/services/container-apps/cloudrun-deployment-guide.md:114-116references/services/container-apps/cloudrun-deployment-guide.md:135-137
Decoded Secrets Passed Through CLI Arguments
Several migration examples pass decoded secret values to az keyvault secret set with --value. This can expose secrets in process listings, command logging, terminal scrollback, or shell history.
The cited lines show decoded Kubernetes or GCP secret values being passed as CLI values. The risk is clear even though the migration intent is legitimate.
RISK-004 Medium
System reconnaissance
--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-005 Medium
System reconnaissance
--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-006 Medium
System reconnaissance
--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY" \
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-007 Medium
System reconnaissance
--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey `
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-008 Medium
System reconnaissance
aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> \
The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.
RISK-009 Medium
System reconnaissance
aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `
The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighDecoded secrets are passed with az keyvault secret set --value in Kubernetes and Cloud Run migration examples.Replace --value secret transfer with protected file input, stdin-safe tooling, or a documented manual step that avoids process arguments and shell history.
- FIX-002HighKubernetes exports include Secret resources in local YAML output.Exclude Secret objects from broad exports by default, or write redacted metadata only unless the user explicitly approves secret migration.
- FIX-003MediumSome deployment examples retrieve Log Analytics or storage account shared keys into shell variables.Prefer identity-based or keyless Azure Monitor and storage patterns, and clearly mark shared-key fallbacks as sensitive manual operations.
- FIX-004MediumTemporary files are used for secret import flows.Keep restrictive permissions and cleanup, but warn users not to run those steps in shared, recorded, or synchronized workspaces.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable