Versioned security assessment
Report ID: SA-DBE0E719
7/8/2026, 8:52:12 AM
azure-deploy security assessment v4
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- azure-deploy
- Version
- v4
- Maintainer
- microsoft
- Coverage
- 42 Files scanned · 3,650 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
4 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static findings are documentation false positives from Markdown formatting, relative links, Azure examples, and expected deployment checks. Confirmed risks remain for remote pipe-to-shell installation, unsafe eval of azd environment output, cloud command execution, SQL role-grant construction, and registry password fallback guidance. No prompt injection attempt was found in the reviewed files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
42 Files scanned · 3,650 Lines analyzed
24 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 23 evidence locations
Filesystem access
May read or write local files.
Observed in 33 evidence locations
Env variables
May read values from the process environment.
Observed in 12 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 160 evidence locations
Capability review items (20)
High
Shell command substitution
ACR_PASS=$(az acr credential show --name <acr-name> --query "passwords[0].value" -o tsv)
The troubleshooting flow retrieves an ACR admin password into a shell variable for docker login. This can expose a registry credential in shell history, process metadata, logs, or later commands.
High
Shell command substitution
eval $(azd env get-values)
The example uses eval on azd environment output, so a crafted environment value could be interpreted by the shell. The safer scripts in this skill show that key-value parsing can avoid this injection path.
High
Shell command substitution
eval $(azd env get-values)
The example uses eval on azd environment output, so a crafted environment value could be interpreted by the shell. The safer scripts in this skill show that key-value parsing can avoid this injection path.
High
Shell command substitution
eval $(azd env get-values)
The example uses eval on azd environment output, so a crafted environment value could be interpreted by the shell. The safer scripts in this skill show that key-value parsing can avoid this injection path.
High
Shell command substitution
IF NOT EXISTS (SELECT * FROM sys.database_principals WHERE name = '$($env:SERVICE_API_NAME)')
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
CREATE USER [$($env:SERVICE_API_NAME)] FROM EXTERNAL PROVIDER;
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
WHERE r.name = 'db_datareader' AND m.name = '$($env:SERVICE_API_NAME)'
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
ALTER ROLE db_datareader ADD MEMBER [$($env:SERVICE_API_NAME)];
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
WHERE r.name = 'db_datawriter' AND m.name = '$($env:SERVICE_API_NAME)'
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
ALTER ROLE db_datawriter ADD MEMBER [$($env:SERVICE_API_NAME)];
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
WHERE r.name = 'db_ddladmin' AND m.name = '$($env:SERVICE_API_NAME)'
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
ALTER ROLE db_ddladmin ADD MEMBER [$($env:SERVICE_API_NAME)];
The SQL example interpolates an environment-derived service name into role-grant statements. The value is likely constrained by Azure naming rules, but unescaped SQL identifiers and string literals create avoidable injection and privilege-grant risk.
High
Shell command substitution
eval $(azd env get-values)
The example uses eval on azd environment output, so a crafted environment value could be interpreted by the shell. The safer scripts in this skill show that key-value parsing can avoid this injection path.
High
Shell command substitution
eval $(azd env get-values)
The example uses eval on azd environment output, so a crafted environment value could be interpreted by the shell. The safer scripts in this skill show that key-value parsing can avoid this injection path.
High
Ruby/shell backtick execution
5. **Scope: deployment execution only** — This skill owns execution of `azd up`, `azd deploy`, `terr
The skill states that it owns execution of azd, Terraform, and Azure deployment commands. These commands can create or modify cloud infrastructure, so the execution risk is real even though it is in scope.
Medium
Unix shell invocation
#!/bin/bash
This is an executable shell helper intended to run Azure and dotnet commands from the user environment. The script is in scope, but it can install tools and modify a live database, so it carries real operational risk.
Medium
Unix shell invocation
#!/bin/bash
This is an executable shell helper intended to run Azure and dotnet commands from the user environment. The script is in scope, but it can install tools and modify a live database, so it carries real operational risk.
Medium
Ruby/shell backtick execution
- Run `azd up`, `azd deploy`, or `az deployment` on a prepared project
The skill explicitly instructs the agent to run Azure deployment commands such as azd up and az deployment. This is expected for the skill, but it is real external command execution against cloud resources.
Medium
Ruby/shell backtick execution
| 4 | **RBAC Health Check** — For Container Apps + ACR with managed identity: run `azd provision --n
The RBAC health check directs execution of azd provision with no prompt before deployment. This can mutate Azure resources and should remain gated by prerequisite and user-confirmation checks.
Medium
Ruby/shell backtick execution
| `mcp_azure_mcp_azd` | Execute AZD commands |
The MCP tool entry is specifically for executing AZD commands. That is a real command execution capability, although it is an intended deployment function.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (4)
RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://aka.ms/install-azd.sh | bash
The quick reference pipes a remote install script directly into bash. This pattern can execute changed or intercepted installer content without local review or checksum verification.
RISK-002 High
references/recipes/azd/post-deployment.md:37-38references/recipes/azd/sql-managed-identity.md:15-17references/recipes/azd/verify.md:84-85
Unsafe azd Environment Evaluation
Several documentation examples load azd environment values with eval. A crafted azd value could be interpreted as shell syntax when users copy these commands.
The eval pattern is explicit and repeated. The input comes from deployment environment values, which are not guaranteed to be safe shell syntax.
RISK-003 High
references/recipes/azd/scripts/grant-and-migrate.sh:62-94references/recipes/azd/scripts/grant-and-migrate.ps1:45-72references/recipes/azd/sql-managed-identity.md:83-155
Unescaped SQL Role Grant Construction
SQL grant scripts build CREATE USER and ALTER ROLE statements with service names read from environment values. Unescaped identifiers and string literals can cause SQL injection or unintended privilege grants.
The role grants are clear and include db_ddladmin. Azure service names are usually constrained, so impact depends on input control, but the construction is still unsafe.
RISK-004 High
Registry Admin Credential Exposure Guidance
Troubleshooting guidance retrieves an Azure Container Registry password and passes it to Docker login. This can expose registry credentials through shell state or command logging.
The password retrieval command is explicit and followed by a password-based login. The document prefers AAD login, but still presents the credential fallback.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalRemote install script is piped directly to bash.Replace the pipe-to-shell installer with package-manager instructions or a downloaded script that users can inspect and verify.
- FIX-002HighSome examples use eval on azd environment output.Use safe key-value parsing like the included shell scripts, and reject unexpected variable names before exporting values.
- FIX-003HighSQL role grants interpolate environment-derived service names.Validate service names against Azure naming rules, escape SQL identifiers and literals, and grant only required roles.
- FIX-004HighACR troubleshooting includes password-based registry login.Prefer Azure AD login and document admin-password fallback only as a last resort with cleanup and log-safety warnings.
- FIX-005MediumDeployment commands can mutate cloud resources with active credentials.Keep subscription, location, validation-proof, and destructive-action confirmations mandatory before running deployment commands.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable