Skills azure-compute

📦

azure-compute

Name: azure-compute
Author: microsoft

v0.0.0-placeholder Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Plan, Deploy, and Troubleshoot Azure Compute

Azure compute decisions and deployment workflows can be complex and risky. This skill guides VM selection, validation, provisioning, capacity reservations, management enrollment, and connectivity troubleshooting.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "azure-compute" from https://skillstore.io/skills/microsoft-azure-compute.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-compute/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-azure-compute.md Signed manifest GET /api/skills/microsoft-azure-compute/manifest Signed lockfile GET /api/skills/microsoft-azure-compute/lockfile

Test it

Using "azure-compute". Recommend a low-cost Linux VM for development in eastus.

Expected outcome:

Primary option: a general-purpose burstable size for intermittent development workloads.
Alternative: a D-series size for sustained CPU and memory use.
Includes retail cost, quota status, availability notes, and selection tradeoffs.

Using "azure-compute". Create a secure Ubuntu VM with Bicep.

Expected outcome:

A reviewed deployment plan followed by Bicep and usage guidance. The plan records region, SKU, image, quota, trusted SSH source, disk, identity, and estimated cost.

Using "azure-compute". My Azure VM rejects SSH connections.

Expected outcome:

An ordered diagnosis covering VM health, public addressing, NSG rules, routes, guest firewall, SSH service, and authentication. State-changing fixes are separated from read-only checks.

Security Audit

High Risk

v5 • 7/23/2026 Open versioned report

Most static alerts are documentation syntax, official Microsoft endpoints, private or sample addresses, and SSH public-key references. Fourteen static findings remain confirmed because they contact a third party or change remote firewall, authentication, privilege, networking, or SELinux state. Semantic review also found shell injection exposure, fail-open ingress, unsafe host-key guidance, broad unconfirmed EMM changes, and plaintext password handling.

Files scanned

3,381

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (16)

High

workflows/vm-troubleshooter/references/firewall-blocking.md:33

System reconnaissance

--command-id RunPowerShellScript \

The paired remote command enables the Windows Remote Desktop firewall rule. This changes guest firewall policy and can increase administrative network exposure.

High

workflows/vm-troubleshooter/references/firewall-blocking.md:48

System reconnaissance

--command-id RunShellScript --scripts "iptables -I INPUT -p tcp --dport 22 -j ACCEPT"

The command inserts an iptables rule that permits inbound SSH. This changes guest firewall policy and may expose port 22 beyond the intended source network.

High

workflows/vm-troubleshooter/references/firewall-blocking.md:52

System reconnaissance

--command-id RunShellScript \

This Run Command begins a persistent firewalld change that opens the SSH service. The operation changes a VM security control and needs explicit approval.

High

workflows/vm-troubleshooter/references/firewall-blocking.md:57

System reconnaissance

--command-id RunShellScript --scripts "ufw status; ufw allow 22/tcp"

The command runs ufw allow for port 22 on the remote VM. It changes firewall policy and can broaden SSH exposure.

High

workflows/vm-troubleshooter/references/ssh-connectivity.md:47

System reconnaissance

--command-id RunShellScript --scripts "setenforce 0"

The command sets SELinux to permissive mode on the remote VM. This weakens mandatory access controls and should only run after explicit approval with a restoration plan.

High

workflows/vm-creator/references/delivery-options/github-pr.md:5-12 workflows/vm-creator/references/delivery-options/github-pr.md:25-51

Unvalidated shell placeholders in GitHub delivery

The workflow accepts user-supplied repository, branch, and target path values, then inserts them into shell commands without validation or consistent quoting. Crafted values could execute unintended commands.

The same file collects user-controlled branch and path values and later places those placeholders in shell command positions. No allowlist validation or complete shell quoting is specified.

High

workflows/vm-creator/references/depth-probe/beginner.md:16

Fail-open management port exposure

The beginner flow permits an unrestricted source when public IP detection fails. This can expose SSH or RDP management ports to the entire internet.

The guidance explicitly allows a wildcard source after detection failure. A warning in the Plan Card does not prevent generation of the exposed configuration.

High

workflows/vm-troubleshooter/references/ssh-connectivity.md:13

SSH host key removal lacks fingerprint verification

The SSH troubleshooting table recommends removing the old known_hosts entry after redeployment without first verifying the replacement host key. This can normalize a man-in-the-middle warning.

The line directly maps host-key verification failure to deleting the stored entry and provides no fingerprint validation step. The omission is security-relevant even in a legitimate redeployment.

Show all 16 confirmed findings

High

workflows/essential-machine-management/references/emm-enable-flow.md:115-137 workflows/essential-machine-management/references/emm-enable-flow.md:162-185

Subscription-wide EMM changes lack a final confirmation gate

The EMM flow registers providers and submits a subscription-level deployment on the user behalf without an explicit final confirmation. Enrollment affects existing VMs and can enable paid services.

The workflow states that Copilot performs commands and API calls, then reaches provider registration and PUT or DELETE operations without a final approval instruction. The documented scope and pricing effects are subscription-wide.

High

workflows/vm-creator/references/output-adapters/az-cli.md:65 workflows/vm-troubleshooter/references/ssh-connectivity.md:33-35 workflows/vm-troubleshooter/references/rdp-connectivity.md:40-41 workflows/vm-troubleshooter/references/credential-auth-errors.md:32-33 workflows/vm-troubleshooter/references/credential-auth-errors.md:48-50

Plaintext passwords in command arguments

Creator and troubleshooting guidance place VM administrator passwords directly in command arguments. These secrets can remain in shell history, transcripts, or process listings.

Each cited command passes a password through an az CLI argument. Command-line secrets can be retained in shell history and exposed through process inspection.

Medium

workflows/vm-troubleshooter/references/credential-auth-errors.md:9

System reconnaissance

| "Your credentials did not work" | Reset password via Portal or CLI

The table recommends resetting a VM password through the portal or CLI. This changes credentials and can affect account access.

Medium

workflows/vm-troubleshooter/references/credential-auth-errors.md:54

System reconnaissance

--command-id RunShellScript --scripts "passwd -u <username>"

The command remotely unlocks a Linux account with passwd. This changes authentication state and should require explicit user confirmation and target verification.

Medium

workflows/vm-troubleshooter/references/network-connectivity.md:57

System reconnaissance

--command-id RunShellScript --scripts "ip link set eth0 up && dhclient eth0"

The remote command brings eth0 up and renews DHCP configuration. It mutates guest networking and could disrupt connectivity if the interface name or configuration is wrong.

Low

workflows/vm-creator/examples/terraform/README.md:14

Network reconnaissance

MY_IP=$(curl -s ifconfig.me)/32 # your current public IP, locked to /32

The command discovers the caller public IP through ifconfig.me. The purpose is narrow NSG scoping, but the lookup still discloses client metadata to a third party.

Low

workflows/vm-creator/references/depth-probe/beginner.md:16

Network reconnaissance

- **NSG:** create new, allow SSH 22 (Linux) or RDP 3389 (Windows) from **the user's current public I

The workflow explicitly instructs using ifconfig.me or an equivalent service to discover the user's public IP. This discloses client network metadata to a third party.

Low

workflows/vm-creator/references/depth-probe/networking-deep.md:9

Network reconnaissance

| NSG | "Inbound rules: default (SSH/RDP from your IP) or paste a rule set?" | Restrict source to us

The workflow explicitly instructs curl to query ifconfig.me for the user's public IP. This sends client network metadata to a third-party service.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

workflows/vm-troubleshooter/references/credential-auth-errors.md:25

sudo privilege escalation

| sudo password prompt fails / user not in sudoers | Fix via Run Command or Serial Consol

The workflow recommends fixing sudo access through Run Command or Serial Console. This can grant administrative privileges and requires explicit authorization.

High

workflows/vm-troubleshooter/references/firewall-blocking.md:33

PowerShell invocation

--command-id RunPowerShellScript \

This Azure Run Command invokes PowerShell to enable the Remote Desktop firewall rule. It changes guest firewall policy and can increase network exposure if applied without explicit approval.

Medium

workflows/vm-creator/examples/terraform/README.md:14

Shell command substitution

MY_IP=$(curl -s ifconfig.me)/32 # your current public IP, locked to /32

This example contacts ifconfig.me to derive the caller public IP for an NSG source. It reveals client metadata to a third-party service and adds an external dependency.

Risk Factors

⚙️ External commands (41)

🌐 Network access (33)

📁 Filesystem access (50)

Detected Patterns

Network reconnaissance×3System reconnaissance×8

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-azure-compute/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-compute/security.svg)](https://skillstore.io/skills/microsoft-azure-compute?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-compute?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-compute/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-compute.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). azure-compute security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-compute/audits/5

BibTeX citation

@techreport{microsoft-microsoft-azure-compute-2026,
  author = {microsoft},
  title = {azure-compute security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/microsoft-azure-compute/audits/5},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-compute security audit report (audit version 5)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-compute/audits/5"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-compute:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Standardize VM deployment

Create a reviewed Azure CLI, Bicep, or Terraform artifact with validated region, image, SKU, quota, and network settings.

Compare capacity and cost

Evaluate VM families, VMSS options, retail prices, quota, and capacity reservations before selecting an architecture.

Restore VM connectivity

Diagnose RDP or SSH failures using ordered checks for VM state, networking, guest services, firewall rules, and credentials.

Try These Prompts

Recommend a development VM

Recommend an Azure VM for a small Linux development server in eastus. Compare two sizes, estimate monthly cost, and explain your choice.

Generate a Bicep deployment

Create a Bicep plan for an Ubuntu VM in westeurope. Restrict SSH to my trusted CIDR and validate SKU, image, and quota first.

Diagnose an SSH timeout

Troubleshoot an SSH timeout for my Azure VM. Start with read-only checks and request approval before changing networking, firewall, credentials, or SELinux.

Design a production VMSS

Design a production VMSS for a stateless service. Compare orchestration, autoscale, zones, cost, quota, security, and capacity reservation options.

Best Practices

Validate region, image, SKU, quota, and estimated cost before generating or applying infrastructure.
Restrict SSH and RDP to explicit trusted CIDR ranges, or use private access and Azure Bastion.
Review every state-changing command and confirm the target subscription, resource group, VM, and expected impact.

Avoid

Do not use wildcard management-port sources when public IP detection fails.
Do not place passwords, private keys, or other credentials in prompts or command-line arguments.
Do not run firewall, account, networking, SELinux, or subscription changes without explicit approval.

Frequently Asked Questions

Can this skill deploy an application?

No. It covers bare VM and VMSS infrastructure and routes application deployment requests to an application-focused workflow.

Which deployment formats are supported?

It can produce Azure CLI, Bicep, or Terraform artifacts. It also supports live VM and VMSS creation through Azure MCP.

Does it verify Azure availability and quota?

Yes, when Azure MCP or authenticated CLI access is available. Otherwise, it reports that preflight validation is reduced.

Are cost estimates exact?

No. Estimates use public retail pricing and may exclude discounts, reservations, taxes, bandwidth, storage, and related services.

Can it change an existing VM?

Yes. Troubleshooting guidance includes commands that can change firewall, credentials, networking, services, or SELinux and therefore require careful approval.

What access is required for live operations?

The user must authenticate to Azure and hold permissions for the selected subscription, resource group, and requested operation.