Skills azure-prepare

📦

azure-prepare

Name: azure-prepare
Author: microsoft

v0.0.0-placeholder Content revision r2 Critical ⚙️ External commands📁 Filesystem access🔑 Env variables🌐 Network access⚡ Contains scripts

Prepare Azure Projects for azd Deployment

Preparing an application for Azure requires coordinated configuration, infrastructure, security, and service choices. This skill creates an approved azd plan and generates deployment artifacts.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "azure-prepare" from https://skillstore.io/skills/microsoft-azure-prepare.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-prepare/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-azure-prepare.md Signed manifest GET /api/skills/microsoft-azure-prepare/manifest Signed lockfile GET /api/skills/microsoft-azure-prepare/lockfile

Test it

Using "azure-prepare". Prepare this Python function for Azure with azd and Bicep.

Expected outcome:

A deployment plan identifies the Function App, storage, managed identity, RBAC roles, region, and quota checks.
The prepared artifacts include azure.yaml, Bicep modules, application settings, and a validation handoff.

Using "azure-prepare". Modernize this API and worker for Azure Container Apps with Terraform.

Expected outcome:

The architecture separates API and worker services, adds managed identity, and defines private service dependencies.
Terraform resources, Dockerfiles, azd configuration, and an approval checklist are prepared for validation.

Using "azure-prepare". Add Azure SQL to this azd project without passwords.

Expected outcome:

The plan selects Entra-only authentication and a managed identity for the application.
The infrastructure includes scoped SQL RBAC, secure settings, and no administrator password.

Security Audit

Critical

v5 • 7/23/2026 Open versioned report

Most static matches are documentation false positives, including Markdown links, SDK environment lookups, and Azure resource identifiers. Confirmed risks include a pipe-to-shell installer, broad network rules, embedded storage keys, and an unsafe session-secret fallback. Semantic review found prompt injection, unverified remote templates, and approval bypasses; 279 capped static matches still require manual review. Static review was capped at 400/679 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

165

Files scanned

16,653

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (16)

Critical

references/sdk/azd-deployment.md:8

Pipe to shell pattern

curl -fsSL https://aka.ms/install-azd.sh | bash

This command downloads a mutable remote installer and pipes it directly into Bash without pinning, checksum verification, or inspection. A compromised redirect or installer would gain arbitrary shell execution.

Critical

SKILL.md:12-14 references/services/functions/templates/README.md:61-75

Prompt Injection Attempt Detected

SKILL.md claims "AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE" and orders exact compliance. The Function template guide states "Skip content verification" because files are "pre-validated," suppressing independent review of remote content.

Both files assert trusted authority and instruct the agent to reduce scrutiny. The remote content is then written and deployed.

Critical

references/services/functions/templates/README.md:61-81 references/services/functions/templates/README.md:136-169

Unvalidated Remote Templates Can Be Written and Deployed

Function guidance writes every remote path and content exactly as supplied, without validating path containment. It then skips review and deploys the result, enabling malicious templates to overwrite files or execute cloud changes.

The instructions explicitly use remote path and content values unchanged, skip content verification, and run azd up without prompts.

High

references/services/app-service/deployment-slots.md:69

Certificate/key files

{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa

The template obtains a storage account key with listKeys() and places the resulting connection string in application settings. Anyone able to read those settings receives a reusable storage credential.

High

references/services/app-service/deployment-slots.md:71

Certificate/key files

{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n

The AzureWebJobsStorage setting embeds a storage account key returned by listKeys(). This creates a long-lived shared credential in the Function App configuration.

High

references/services/app-service/deployment-slots.md:91

Certificate/key files

{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa

The staging-slot template stores a listKeys() storage credential in WEBSITE_CONTENTAZUREFILECONNECTIONSTRING. Slot configuration readers can recover and reuse that account key.

High

references/services/app-service/deployment-slots.md:93

Certificate/key files

{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n

The staging slot receives AzureWebJobsStorage as a shared-key connection string. This exposes a reusable storage credential through application settings.

High

references/services/functions/bicep.md:176

Certificate/key files

{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n

The Bicep example calls listKeys() and embeds the storage account key in AzureWebJobsStorage. Managed identity settings would avoid placing this reusable credential in app configuration.

Show all 16 confirmed findings

High

references/services/functions/bicep.md:212

Certificate/key files

{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa

The Function App content connection string contains a storage account key obtained through listKeys(). The generated application settings therefore hold a reusable shared credential.

High

references/services/functions/bicep.md:214

Certificate/key files

{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n

The AzureWebJobsStorage value embeds a listKeys() account key in the production Function App settings. This increases exposure compared with identity-based storage configuration.

High

references/services/functions/bicep.md:234

Certificate/key files

{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa

The staging slot stores a storage account key inside WEBSITE_CONTENTAZUREFILECONNECTIONSTRING. Access to slot settings would disclose a credential usable outside the application.

High

references/services/functions/bicep.md:236

Certificate/key files

{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n

The staging AzureWebJobsStorage setting contains a shared storage account key from listKeys(). This creates avoidable secret material in deployment configuration.

High

references/runtimes/nodejs.md:117

Environment file access

secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',

The production configuration falls back to the known value dev-secret-change-in-prod when SESSION_SECRET is absent. A production misconfiguration would permit attackers to forge signed sessions.

High

SKILL.md:39 references/services/functions/templates/recipes/composition.md:38 references/services/functions/templates/recipes/composition.md:79 references/services/functions/templates/recipes/composition.md:123-129 references/services/functions/templates/recipes/composition.md:202-215 references/recipes/azd/terraform.md:227-245

Bundled References Bypass Approval and Validation

The core skill limits itself to preparation and requires approval plus validation. Bundled references instead deploy without prompts, which can provision billable resources before the required handoff.

The core rule forbids deployment, while the loaded Function workflow explicitly deploys and requires noninteractive commands.

High

references/services/container-apps/day2-operations.md:108-118

Shell Secret Substitution Can Expose Plaintext

The guidance claims command substitution avoids process-list exposure. Shell expansion places the secret in the Azure CLI argument vector, where local process inspection or logging may capture it.

The documented command expands secret.txt into a command-line argument, despite the adjacent claim that this avoids process-list disclosure.

High

references/services/event-grid/bicep.md:6-12 references/services/event-grid/bicep.md:45-52 references/services/event-grid/bicep.md:64-71

Event Grid Template Uses Public Shared-Key Access

The Event Grid pattern enables public network access and authenticates publishers with a topic key from environment variables. This conflicts with the skill's private-network and managed-identity guidance.

The template explicitly enables public access and constructs both clients with a reusable EVENTGRID_TOPIC_KEY.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/services/durable-task-scheduler/bicep.md:21

Hardcoded IP address

ipAllowlist: ['0.0.0.0/0'] // Required: empty list denies all traffic

The generated ipAllowlist uses 0.0.0.0/0, explicitly allowing traffic from every IPv4 address. RBAC remains required, but the network boundary is removed for the scheduler endpoint.

High

references/services/container-apps/day2-operations.md:22

Unix shell invocation

az containerapp exec -n $APP -g $RG --command /bin/sh

This command opens /bin/sh inside a running Azure Container App. It enables arbitrary remote command execution and access to runtime data without an explicit confirmation requirement at this location.

High

references/services/container-apps/day2-operations.md:28

Unix shell invocation

--command /bin/sh

The command argument launches a remote shell in the live container. That shell can inspect secrets or modify runtime state, so it should require explicit operator confirmation.

High

references/runtimes/nodejs.md:117

Environment variable access (dot notation)

secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',

This environment lookup has a fixed, publicly documented fallback secret. If SESSION_SECRET is missing in production, session signatures become predictable.

High

references/runtimes/nodejs.md:117

Environment variable object

secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',

The sample reads SESSION_SECRET but silently substitutes a known default. That default can enable session forgery when the deployment omits the environment variable.

Medium

references/services/sql-database/bicep.md:49

Hardcoded IP address

startIpAddress: '0.0.0.0'

In an Azure SQL firewall rule, 0.0.0.0 is the special Allow Azure services setting. It permits network access from resources across Azure instead of limiting access to this application.

Medium

references/services/sql-database/bicep.md:50

Hardcoded IP address

endIpAddress: '0.0.0.0'

The matching end address completes Azure SQL's broad Allow Azure services firewall rule. Authentication is still required, but the database network boundary is much wider than necessary.

Medium

references/services/app-service/templates/web-app.md:108

Hardcoded URL

CSRF_TRUSTED_ORIGINS = ['https://*.azurewebsites.net']

The Django template trusts every azurewebsites.net subdomain as a CSRF origin. Because unrelated tenants can control those subdomains, the trust pattern is broader than the deployed application's origin.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (50)

🔑 Env variables (50)

🌐 Network access (50)

⚡ Contains scripts (8)

references/services/durable-task-scheduler/dotnet.md:63 references/services/durable-task-scheduler/dotnet.md:72 references/services/durable-task-scheduler/dotnet.md:80 references/services/durable-task-scheduler/dotnet.md:90 references/services/durable-task-scheduler/dotnet.md:106 references/services/durable-task-scheduler/dotnet.md:140 references/services/functions/templates/recipes/common/health-check.md:54 references/services/functions/templates/recipes/common/nodejs-entry-point.md:81

Detected Patterns

Pipe to shell pattern

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-azure-prepare/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-prepare/security.svg)](https://skillstore.io/skills/microsoft-azure-prepare?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-prepare?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-prepare/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-prepare.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). azure-prepare security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-prepare/audits/5

BibTeX citation

@techreport{microsoft-microsoft-azure-prepare-2026,
  author = {microsoft},
  title = {azure-prepare security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/microsoft-azure-prepare/audits/5},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-prepare security audit report (audit version 5)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-prepare/audits/5"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-prepare:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Prepare a New Azure Application

Create an approved azd plan, service mapping, infrastructure, and application configuration for a new project.

Modernize an Existing Service

Preserve existing code while adding managed Azure services, containers, identity, networking, and deployment configuration.

Design Multi-Service Infrastructure

Plan Bicep or Terraform resources, RBAC, quotas, and service dependencies for a coordinated Azure architecture.

Try These Prompts

Prepare an Existing Application

Prepare this application for Azure with azd. Inspect the workspace and create the required deployment plan. Do not execute the plan until I approve it.

Generate Bicep for a Web API

Create azd configuration and Bicep infrastructure for this Node.js API. Use managed identity and document every resource choice before generating files.

Modernize with Terraform

Modernize this multi-service application for Azure Container Apps with azd and Terraform. Preserve existing code and propose a phased plan for approval.

Plan an Event-Driven Platform

Design Azure Functions with Service Bus and Durable Task Scheduler. Include RBAC, networking, quota checks, and validation handoff. Do not deploy.

Best Practices

Review and approve the deployment plan before any file generation or cloud action.
Use managed identity and narrowly scoped RBAC instead of keys, passwords, or broad roles.
Validate generated infrastructure, network boundaries, quotas, and cost assumptions before deployment.

Avoid

Do not run remote installers or templates without pinning and verification.
Do not deploy from the preparation workflow or bypass the validation handoff.
Do not expose public endpoints, shared keys, or plaintext secrets by default.

Frequently Asked Questions

Does this skill deploy resources to Azure?

Its primary workflow prepares artifacts and hands them to validation. Some bundled references currently contain direct deployment commands and require remediation.

Which infrastructure formats can it generate?

It supports Bicep and Terraform patterns for azd projects, plus azure.yaml and service Dockerfiles.

Can it modify an existing application?

Yes. It can preserve existing code while adding Azure configuration, infrastructure, identity, networking, and service integrations.

How does it handle Azure credentials?

The guidance prefers managed identity and Azure RBAC. Generated shared-key settings and local environment files still require careful review.

Does it require user confirmation?

Yes. The main workflow requires approval of the deployment plan, subscription, region, destructive actions, and significant cost decisions.

Is the generated infrastructure production ready?

It provides detailed starting patterns. Teams must still verify policy compliance, private networking, quotas, service versions, monitoring, and recovery requirements.