Versioned security assessment

Report ID: SA-DBE0E719

7/8/2026, 9:10:46 AM

azure-kubernetes security assessment v4

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: azure-kubernetes
Version: v4
Maintainer: microsoft
Source: github.com/microsoft/azure-skills/tree/main/.github/plugins/azure-skills/skills/azure-kubernetes/
Coverage: 11 Files scanned · 1,975 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

High

7 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives caused by Markdown backticks, Kubernetes field names, documentation URLs, and safety examples. Confirmed risks relate to Azure CLI or MCP actions against live cloud resources, AKS credential permissions, temporary export of cluster manifests, and RBAC grant guidance. No prompt injection attempt was found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

11 Files scanned · 1,975 Lines analyzed

20 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 5 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 81 evidence locations

Capability review items (13)

High

azure-kubernetes-automatic-readiness/SKILL.md:99-101

Ruby/shell backtick execution

- `Microsoft.ContainerService/managedClusters/listClusterUserCredential/action`

The required permission includes listClusterUserCredential/action, which can retrieve AKS user credentials. This is sensitive even when needed for assessment.

Medium

azure-kubernetes-automatic-readiness/references/mcp-integration.md:52

Shell command substitution

--assignee $(az ad signed-in-user show --query id -o tsv) \

The bash example runs Azure CLI with shell substitution to query the signed-in user and role assignments. This is legitimate guidance, but it accesses tenant identity and cluster-scope RBAC data.

Medium

azure-kubernetes-automatic-readiness/references/mcp-integration.md:158

Temp directory access

kubectl get deployment,statefulset,daemonset,job,cronjob -A -o yaml > /tmp/workloads.yaml

The fallback command exports cluster-wide workload YAML to /tmp. That file can expose workload metadata and should not be written to shared temporary paths without consent or redaction.

Medium

azure-kubernetes-automatic-readiness/references/mcp-integration.md:159

Temp directory access

kubectl get pdb,storageclass -A -o yaml > /tmp/policies.yaml

The fallback command exports cluster policy YAML to /tmp. Cluster policy metadata can be sensitive and should use a user-approved restricted path or in-memory processing.

Medium

azure-kubernetes-automatic-readiness/SKILL.md:57

Ruby/shell backtick execution

| `mcp_azure_mcp_aks` | AKS MCP entry point — call `discover` first, then use the assessment action

The MCP tool entry operates against AKS resources using subscription, resource group, and cluster identifiers. Live cluster access is legitimate but requires least privilege and user authorization.

Medium

azure-kubernetes-automatic-readiness/SKILL.md:78

Ruby/shell backtick execution

Call the AKS MCP tool — this is the preferred path. Always call `discover` first to get the availabl

The workflow explicitly instructs the agent to call AKS MCP discovery and assessment actions. This can access live Azure and cluster metadata, so it is a real operational risk.

Medium

azure-kubernetes-automatic-readiness/SKILL.md:80-95

Ruby/shell backtick execution

```javascript

The code block calls mcp_azure_mcp_aks with subscription, resource group, and cluster parameters. That live assessment can access tenant resources and workload metadata.

Medium

azure-kubernetes-automatic-readiness/SKILL.md:234

Ruby/shell backtick execution

| MCP tool call fails or times out | Invalid credentials or subscription context | Verify `az login`

The troubleshooting guidance tells the agent to verify az login and az account show. These commands read local Azure authentication state and subscription metadata.

Medium

SKILL.md:21

Ruby/shell backtick execution

| CLI | `az aks create`, `az aks show`, `kubectl get`, `kubectl describe` |

The quick reference lists az aks and kubectl commands the skill may use. These tools can read or modify cluster state, so execution must be authorized by the user.

Medium

SKILL.md:38

Ruby/shell backtick execution

2. Use the `azure` MCP server and select `mcp_azure_mcp_aks` first to discover the exact AKS-specifi

The rule instructs use of Azure MCP and fallback to Azure CLI. This is expected for AKS operations, but it can operate on live cloud resources.

Medium

SKILL.md:122

Ruby/shell backtick execution

- **Stop/Start** dev/test clusters: `az aks stop/start`

The az aks stop/start guidance is a state-changing cluster operation. It is valid cost guidance but should never run without explicit approval.

Medium

SKILL.md:138

Ruby/shell backtick execution

- Do not ask the user to paste subscription IDs. Discover subscription and resource scope via MCP to

The rule tells the agent to use MCP or az account show/list to discover subscription scope. This reads cloud account metadata and must be handled carefully.

Medium

SKILL.md:150

Ruby/shell backtick execution

| MCP tool call fails or times out | Invalid credentials, subscription, or AKS context | Verify `az

The troubleshooting table advises az login and az account show. These commands read local Azure authentication state and subscription metadata.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 High

azure-kubernetes-automatic-readiness/references/mcp-integration.md:59-63

Azure RBAC Grant Command

The MCP integration reference includes an az role assignment create command for the Azure Kubernetes Service Cluster User Role. If an agent ran it without explicit approval, it could grant cluster access.

The command is shown directly and requires Owner or User Access Administrator rights. It is legitimate documentation but materially changes Azure RBAC.

RISK-002 Medium

azure-kubernetes-automatic-readiness/references/constraint-spec-v1.yaml:39

System reconnaissance

fix: "az aks update --enable-apiserver-vnet-integration --apiserver-subnet-id <subnet-id>"

The fix string is an az aks update command that changes cluster networking configuration. It is legitimate remediation guidance, but it is a live Azure mutation requiring explicit approval.

RISK-003 Medium

references/cli-reference.md:33

System reconnaissance

--addons monitoring --workspace-resource-id <workspace-resource-id>

The line is part of an az aks enable-addons command that changes monitoring configuration. The reconnaissance label is imprecise, but the command is a real cluster change.

RISK-004 Low

azure-kubernetes-automatic-readiness/references/mcp-integration.md:52

System reconnaissance

--assignee $(az ad signed-in-user show --query id -o tsv) \

The command reads Azure identity and role assignment data for the current user. It is expected for setup checks, but it is still cloud account reconnaissance and should require user authorization.

RISK-005 Low

azure-kubernetes-automatic-readiness/references/mcp-integration.md:159

Network reconnaissance

kubectl get pdb,storageclass -A -o yaml > /tmp/policies.yaml

The command collects cluster policy inventory across namespaces. The network-recon label is imprecise, but the cluster-wide inventory is sensitive operational metadata.

RISK-006 Low

azure-kubernetes-automatic-readiness/SKILL.md:234

System reconnaissance

| MCP tool call fails or times out | Invalid credentials or subscription context | Verify `az login`

The line advises checking az login and az account show, which reads account context. The use is legitimate troubleshooting, but it still exposes cloud account metadata.

RISK-007 Low

SKILL.md:150

System reconnaissance

| MCP tool call fails or times out | Invalid credentials, subscription, or AKS context | Verify `az

The line advises checking az login and az account show, which reads cloud account context. It is legitimate troubleshooting, but still account metadata access.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
High
The MCP integration reference includes an Azure RBAC role assignment command.

Do not auto-run role assignment commands. Present them as manual steps, require explicit approval, and use least-privilege scope.
FIX-002
High
Live assessment requires sensitive AKS credential-related permissions.

Document why listClusterUserCredential/action is needed and offer offline manifest validation when users cannot grant that permission.
FIX-003
Medium
Azure CLI and MCP operations can read or change live AKS resources.

Require explicit user approval before live Azure actions, show the exact command or tool call, and prefer read-only operations when possible.
FIX-004
Medium
Fallback guidance writes cluster inventory files to /tmp.

Use a user-approved restricted workspace path or in-memory processing, and redact sensitive workload fields before saving.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable