Versioned security assessment

Report ID: SA-DBE0E719

7/8/2026, 9:23:52 AM

azure-prepare security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
azure-prepare
Version
v4
Maintainer
microsoft
Source
github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-prepare/
Coverage
165 Files scanned · 16,653 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

14 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is primarily Markdown guidance for preparing azd-based Azure deployments, and most static findings are benign references, placeholders, or security-aware examples. Confirmed risks remain for a remote pipe-to-shell installer, storage account key-derived app settings, and a hardcoded session-secret fallback in Node.js guidance. Additional context risks include mandatory hidden plan-file writes, potential exposure of azd environment values, and optional broad SQL database grants.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

165 Files scanned · 16,653 Lines analyzed

16 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 8 evidence locations

Network access

May connect to external services.

Observed in 66 evidence locations

Filesystem access

May read or write local files.

Observed in 55 evidence locations

Env variables

May read values from the process environment.

Observed in 84 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 160 evidence locations

Capability review items (2)
High
references/runtimes/nodejs.md:117
Environment variable access (dot notation)
secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',
The example falls back to a literal session secret when SESSION_SECRET is missing. If copied into production, cookie signing would depend on a predictable default value.
High
references/runtimes/nodejs.md:117
Environment variable object
secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',
The example falls back to a literal session secret when SESSION_SECRET is missing. If copied into production, cookie signing would depend on a predictable default value.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (14)

RISK-001 Critical
references/sdk/azd-deployment.md:8
Pipe to shell pattern
curl -fsSL https://aka.ms/install-azd.sh | bash
The install guidance pipes a remote script from aka.ms directly into bash. Even though it installs azd, this pattern executes network content without local integrity verification.
RISK-002 High
references/runtimes/nodejs.md:117
Environment file access
secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',
The example falls back to a literal session secret when SESSION_SECRET is missing. If copied into production, cookie signing would depend on a predictable default value.
RISK-003 High
references/services/app-service/deployment-slots.md:69
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-004 High
references/services/app-service/deployment-slots.md:71
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-005 High
references/services/app-service/deployment-slots.md:91
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-006 High
references/services/app-service/deployment-slots.md:93
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-007 High
references/services/functions/bicep.md:176
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-008 High
references/services/functions/bicep.md:212
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-009 High
references/services/functions/bicep.md:214
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-010 High
references/services/functions/bicep.md:234
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-011 High
references/services/functions/bicep.md:236
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The Bicep app setting builds a storage connection string using an account key from listKeys. This is standard for some Functions scenarios, but it places a sensitive key-derived value into generated app configuration.
RISK-012 Medium
SKILL.md:31SKILL.md:50-56
Mandatory Hidden Plan File Write Before Approval
The skill requires creating .azure/deployment-plan.md in the workspace as the first action, before the plan is complete and before normal execution approval.
The instructions explicitly require an immediate workspace file write and repeat that the hidden .azure path must exist. The behavior is intentional and not just a static path match.
RISK-013 Medium
references/aspire.md:252-263references/services/sql-database/scripts/grant-sql-access.sh:26-36references/services/sql-database/scripts/grant-sql-access.ps1:25-29
azd Environment Values May Be Displayed or Loaded
Several references use azd env get-values to verify or load environment values. These values can include deployment secrets, so careless logging can expose sensitive configuration.
The command is shown directly and the scripts load all azd environment values into process variables. The risk is exposure through logs or shell history rather than deliberate exfiltration.
RISK-014 Medium
references/services/sql-database/scripts/grant-sql-access.sh:70-80references/services/sql-database/scripts/grant-sql-access.ps1:62-73
Optional Broad SQL Database Role Grant
The SQL access helper can grant db_ddladmin to an application identity when SQL_GRANT_DDLADMIN is true. This may exceed least privilege after migrations finish.
Both scripts conditionally add the application identity to db_ddladmin. The comments explain the migration use case, but the privilege remains broad if left enabled.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly into bash.
    Replace pipe-to-shell installation with downloaded script verification, package-manager instructions, or a checksum-verified installer path.
  2. FIX-002
    High
    Some Bicep examples generate storage account key connection strings for Function App settings.
    Prefer managed identity storage access where supported, or clearly mark key-based connection strings as compatibility-only with rotation guidance.
  3. FIX-003
    High
    Node.js runtime guidance includes a fallback literal session secret.
    Remove the fallback secret and fail startup when SESSION_SECRET is missing outside local development.
  4. FIX-004
    Medium
    The workflow mandates writing .azure/deployment-plan.md before full user approval.
    Ask for explicit consent before creating hidden workspace files, or allow a dry-run plan preview before writing to disk.
  5. FIX-005
    Medium
    azd environment values can include secrets and may be printed or loaded broadly.
    Avoid displaying azd env get-values output, redact secret-like names, and load only required variables in helper scripts.
  6. FIX-006
    Medium
    SQL helper scripts can grant db_ddladmin to application identities.
    Limit db_ddladmin to migration windows, document rollback steps, and prefer dedicated migration identities.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable