Versioned security assessment
Report ID: SA-EBDFE608
7/23/2026, 5:55:12 PM
azure-cloud-migrate security assessment v6
Skill Security Certification Report
Scanner version 3.0.0 Audit model: codex Latest published report
- Skill name
- azure-cloud-migrate
- Version
- v0.0.0-placeholder
- Maintainer
- microsoft
- Coverage
- 32 Files scanned · 4,622 Lines analyzed
- Policy version
- skillstore-security-audit-policy-v1
Highest confirmed finding severity
High
9 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most of the 400 presented findings are documentation false positives involving links, code fences, managed identity examples, and visible migration commands. Confirmed risks involve shared cloud keys, decoded secret transfer through CLI arguments, and local secret materialization. The 30 omitted static matches require manual review before publication. Static review was capped at 400/430 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Active attestation
A public attestation is available for this exact report.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
32 Files scanned · 4,622 Lines analyzed
23 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 12 evidence locations
Network access
May connect to external services.
Observed in 23 evidence locations
Filesystem access
May read or write local files.
Observed in 7 evidence locations
Env variables
May read values from the process environment.
Observed in 33 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 55 evidence locations
Capability review items (14)
High
Database connection strings
read -s -p "Enter database password: " DB_PASSWORD
The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.
High
Database connection strings
echo -n "$DB_PASSWORD" > "$SECRET_FILE"
The example asks for a database password and writes it into a temporary file for Key Vault import. Cleanup is present, but the flow still materializes secret data locally.
High
Shell command substitution
--value "$(gcloud secrets versions access latest --secret=<secret-id> --project="$GCP_PROJECT")"
The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.
High
Shell command substitution
az keyvault secret set --vault-name myapp-kv --name password --value "$(kubectl get secret mysecret
The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.
Medium
Ruby/shell backtick execution
aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `
The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.
Medium
Ruby/shell backtick execution
--azure-file-account-name "$STORAGE_ACCOUNT" --azure-file-account-key "$STORAGE_KEY" `
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
Medium
Shell command substitution
LOG_KEY=$(az monitor log-analytics workspace get-shared-keys -g "$RG" -n "${RG}-logs" --query primar
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Shell command substitution
LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group myapp-rg --workspace-n
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Shell command substitution
secret_file="$(mktemp)"
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Medium
Shell command substitution
LOG_KEY=$(az monitor log-analytics workspace get-shared-keys --resource-group spring-rg --workspace-
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Shell command substitution
STORAGE_KEY=$(az storage account keys list --account-name "$STORAGE_ACCOUNT" --resource-group spring
The command retrieves cloud shared keys into shell variables. These keys are sensitive credentials and can be exposed through logs, history, or subsequent command arguments.
Medium
Shell command substitution
SECRET_FILE=$(mktemp)
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Medium
Temp file creation
secret_file="$(mktemp)"
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Medium
Temp file creation
SECRET_FILE=$(mktemp)
The temp file is created specifically for secret migration. Permissions and cleanup reduce exposure, but local secret materialization remains a security risk.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (9)
RISK-001 High
System reconnaissance
> **Tip**: Prefer piping decoded secret values directly to `az keyvault secret set --value` to avoid
The line recommends or uses command-line secret transfer through az keyvault secret set --value. That can expose decoded secret material through process arguments, logs, or shell history.
RISK-002 High
Kubernetes Secrets Exported Into Workspace
The guide exports deployments, services, ingress, ConfigMaps, and Secret objects to all-resources.yaml. Base64-encoded Kubernetes secrets can remain recoverable in the workspace.
The command explicitly includes Secret objects in a YAML export file. This directly materializes sensitive values during migration.
RISK-003 High
references/services/container-apps/deployment-guide.md:89-91references/services/container-apps/deployment-guide.md:108-112references/services/container-apps/cloudrun-deployment-guide.md:114-116references/services/container-apps/cloudrun-deployment-guide.md:135-137
Decoded Secrets Passed Through CLI Arguments
Several examples pass decoded secrets to az keyvault secret set with --value. Process listings, command logging, terminal history, or shell history may expose them.
The cited examples retrieve decoded secret values and pass them as CLI arguments. The exposure risk is direct despite legitimate migration intent.
RISK-004 Medium
System reconnaissance
--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY"
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-005 Medium
System reconnaissance
--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-006 Medium
System reconnaissance
--logs-workspace-id "$LOG_ID" --logs-workspace-key "$LOG_KEY" \
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-007 Medium
System reconnaissance
--logs-workspace-id $workspace.customerId --logs-workspace-key $keys.primarySharedKey `
The line passes a retrieved cloud key as a command argument. This is a legitimate deployment pattern, but it increases the chance of secret exposure in local process or logging surfaces.
RISK-008 Medium
System reconnaissance
aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> \
The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.
RISK-009 Medium
System reconnaissance
aws secretsmanager get-secret-value --secret-id <secret-id> --region <region> `
The command extracts live AWS Secrets Manager values during migration. The guide uses cleanup controls, but the secret is still materialized in the local execution environment.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighDecoded secrets are passed through az keyvault secret set --value in Kubernetes and Cloud Run migration examples.Use protected file input, stdin-safe tooling, or a manual step that avoids process arguments and shell history.
- FIX-002HighKubernetes exports include Secret objects in local YAML output.Exclude Secret objects by default, or export redacted metadata unless the user explicitly approves secret migration.
- FIX-003MediumStatic review cappedManually review the omitted 30 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-004MediumSome deployment examples retrieve Log Analytics or storage account shared keys into shell variables.Prefer identity-based Azure Monitor and storage patterns. Mark shared-key fallbacks as sensitive manual operations.
- FIX-005MediumTemporary files store secrets during import flows.Keep restrictive permissions and cleanup. Warn users against running these steps in shared, recorded, or synchronized workspaces.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Content hash
- 6749b6cbca0ddd1f7ac831b23d825d0a4437af755fd7068f8723621a68449488
- Tree hash
- fd334b4c8f2a88f6fd96bd57d60c5050e6e4b5802427229796f709bdc97fec3d
- Skill path
- skills/microsoft/azure-cloud-migrate
- Audit payload hash
- dc2be770107a847125474a59f8202521
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: active