Versioned security assessment

Report ID: SA-9CD6A227

7/6/2026, 5:56:37 PM

azure-prepare security assessment v3

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: azure-prepare
Version: v3
Maintainer: microsoft
Source: github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-prepare/
Coverage: 183 Files scanned · 18,434 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are benign Markdown examples, relative documentation links, Azure project paths, or environment variable placeholders. I confirmed the pipe-to-shell installer, permissive SQL firewall examples, and a storage key written into app settings. I also found prompt-injection language, user-confirmation bypass guidance, secret printing examples, and shared-key IaC patterns.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

183 Files scanned · 18,434 Lines analyzed

12 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 22 evidence locations

Network access

May connect to external services.

Observed in 54 evidence locations

Filesystem access

May read or write local files.

Observed in 126 evidence locations

Env variables

May read values from the process environment.

Observed in 48 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 203 evidence locations

Capability review items (6)

High

references/services/functions/templates/recipes/sql/bicep/sql.bicep:103

Hardcoded IP address

startIpAddress: '0.0.0.0'

The SQL firewall example uses 0.0.0.0 for the allow rule, which enables broad Azure service access to the database server. This is a permissive network default that should require explicit justification.

High

references/services/functions/templates/recipes/sql/bicep/sql.bicep:104

Hardcoded IP address

endIpAddress: '0.0.0.0'

High

references/services/functions/templates/recipes/sql/terraform/sql.tf:83

Hardcoded IP address

start_ip_address = "0.0.0.0"

High

references/services/functions/templates/recipes/sql/terraform/sql.tf:84

Hardcoded IP address

end_ip_address = "0.0.0.0"

High

references/services/sql-database/bicep.md:45

Hardcoded IP address

startIpAddress: '0.0.0.0'

High

references/services/sql-database/bicep.md:46

Hardcoded IP address

endIpAddress: '0.0.0.0'

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical

references/sdk/azd-deployment.md:8

Pipe to shell pattern

curl -fsSL https://aka.ms/install-azd.sh | bash

The reference tells users to run a remote installer through curl piped directly to bash. Even for an official Azure URL, this pattern executes network content without inspection or integrity verification.

RISK-002 Critical

SKILL.md:11-13

Prompt Injection Attempt Detected

SKILL.md labels itself authoritative and tells the agent to IGNORE prior training because it supersedes all other sources. This attempts to override higher-priority instructions during skill execution.

The file uses explicit authority, ignore, and supersede language in the primary skill instructions. This directly matches prompt injection indicators from the audit instructions.

RISK-003 High

references/services/functions/bicep.md:149

Certificate/key files

{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n

The Bicep example writes a storage account key into the AzureWebJobsStorage app setting using listKeys(). That places a long-lived shared key in application configuration.

RISK-004 High

references/services/functions/templates/SPEC-composable-templates.md:24-26 references/services/functions/templates/SPEC-composable-templates.md:541-542

User Confirmation Bypass Guidance

The template specification rewards zero user intervention and says the agent never asks for more information. That conflicts with approval and ask_user safety gates for Azure context and destructive actions.

The guidance appears twice in the same specification and explicitly discourages user elicitation. The risk is contextual because it is in a template spec, not the top-level rules.

RISK-005 High

references/services/key-vault/sdk.md:14-15 references/services/key-vault/sdk.md:29-30 references/services/key-vault/sdk.md:41-42

Secret Values Printed in Key Vault Examples

The Key Vault SDK examples retrieve a database secret and immediately print the secret value. Copying this pattern can expose production secrets in logs or chat output.

Node.js, Python, and .NET examples print the retrieved secret value directly. This is clear secret disclosure behavior even though it appears in example code.

RISK-006 High

references/services/functions/bicep.md:149 references/services/container-apps/bicep.md:72-73 references/services/logic-apps/bicep.md:82-83

Shared Access Keys Embedded in IaC Configuration

Several Bicep examples use listKeys to place storage, Log Analytics, or Service Bus shared keys directly into app configuration. Long-lived shared keys should be replaced with managed identity or Key Vault references where supported.

The examples directly call listKeys and assign the returned shared keys into resource configuration. This is a concrete secret-handling weakness in generated IaC guidance.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Critical
Prompt injection language in the primary skill instructions.

Remove claims that the skill supersedes other instructions or tells the agent to ignore prior guidance. Use ordinary skill-scoped workflow language.
FIX-002
Critical
Remote installer is piped directly to bash.

Replace curl pipe-to-shell installation with a link to official installation steps, checksum verification, or package manager commands.
FIX-003
High
Template specification discourages user elicitation.

Align evaluation criteria with required approval, Azure context confirmation, and destructive-action confirmation gates.
FIX-004
High
Examples print retrieved Key Vault secret values.

Remove secret value printing and show safe use patterns that pass secrets directly to clients without logging.
FIX-005
High
IaC examples embed shared keys and broad SQL firewall rules.

Prefer managed identity, Key Vault references, private endpoints, and narrow firewall rules over listKeys and 0.0.0.0 allow rules.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (26)

Critical

references/architecture.md:69

Azure credentials directory

Record selections in `.azure/plan.md` with rationale for each choice.