Versioned security assessment
Report ID: SA-EBDFE608
7/23/2026, 6:56:46 PM
azure-prepare security assessment v5
Skill Security Certification Report
Scanner version 3.0.0 Audit model: codex Latest published report
- Skill name
- azure-prepare
- Version
- v0.0.0-placeholder
- Maintainer
- microsoft
- Coverage
- 165 Files scanned · 16,653 Lines analyzed
- Policy version
- skillstore-security-audit-policy-v1
Highest confirmed finding severity
Critical
16 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static matches are documentation false positives, including Markdown links, SDK environment lookups, and Azure resource identifiers. Confirmed risks include a pipe-to-shell installer, broad network rules, embedded storage keys, and an unsafe session-secret fallback. Semantic review found prompt injection, unverified remote templates, and approval bypasses; 279 capped static matches still require manual review. Static review was capped at 400/679 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Active attestation
A public attestation is available for this exact report.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
165 Files scanned · 16,653 Lines analyzed
24 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 8 evidence locations
Network access
May connect to external services.
Observed in 52 evidence locations
Filesystem access
May read or write local files.
Observed in 48 evidence locations
Env variables
May read values from the process environment.
Observed in 26 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 52 evidence locations
Capability review items (8)
High
Hardcoded IP address
ipAllowlist: ['0.0.0.0/0'] // Required: empty list denies all traffic
The generated ipAllowlist uses 0.0.0.0/0, explicitly allowing traffic from every IPv4 address. RBAC remains required, but the network boundary is removed for the scheduler endpoint.
High
Unix shell invocation
az containerapp exec -n $APP -g $RG --command /bin/sh
This command opens /bin/sh inside a running Azure Container App. It enables arbitrary remote command execution and access to runtime data without an explicit confirmation requirement at this location.
High
Unix shell invocation
--command /bin/sh
The command argument launches a remote shell in the live container. That shell can inspect secrets or modify runtime state, so it should require explicit operator confirmation.
High
Environment variable access (dot notation)
secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',
This environment lookup has a fixed, publicly documented fallback secret. If SESSION_SECRET is missing in production, session signatures become predictable.
High
Environment variable object
secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',
The sample reads SESSION_SECRET but silently substitutes a known default. That default can enable session forgery when the deployment omits the environment variable.
Medium
Hardcoded IP address
startIpAddress: '0.0.0.0'
In an Azure SQL firewall rule, 0.0.0.0 is the special Allow Azure services setting. It permits network access from resources across Azure instead of limiting access to this application.
Medium
Hardcoded IP address
endIpAddress: '0.0.0.0'
The matching end address completes Azure SQL's broad Allow Azure services firewall rule. Authentication is still required, but the database network boundary is much wider than necessary.
Medium
Hardcoded URL
CSRF_TRUSTED_ORIGINS = ['https://*.azurewebsites.net']
The Django template trusts every azurewebsites.net subdomain as a CSRF origin. Because unrelated tenants can control those subdomains, the trust pattern is broader than the deployed application's origin.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (16)
RISK-001 Critical
Pipe to shell pattern
curl -fsSL https://aka.ms/install-azd.sh | bash
This command downloads a mutable remote installer and pipes it directly into Bash without pinning, checksum verification, or inspection. A compromised redirect or installer would gain arbitrary shell execution.
RISK-002 Critical
Prompt Injection Attempt Detected
SKILL.md claims "AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE" and orders exact compliance. The Function template guide states "Skip content verification" because files are "pre-validated," suppressing independent review of remote content.
Both files assert trusted authority and instruct the agent to reduce scrutiny. The remote content is then written and deployed.
RISK-003 Critical
references/services/functions/templates/README.md:61-81references/services/functions/templates/README.md:136-169
Unvalidated Remote Templates Can Be Written and Deployed
Function guidance writes every remote path and content exactly as supplied, without validating path containment. It then skips review and deploys the result, enabling malicious templates to overwrite files or execute cloud changes.
The instructions explicitly use remote path and content values unchanged, skip content verification, and run azd up without prompts.
RISK-004 High
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The template obtains a storage account key with listKeys() and places the resulting connection string in application settings. Anyone able to read those settings receives a reusable storage credential.
RISK-005 High
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The AzureWebJobsStorage setting embeds a storage account key returned by listKeys(). This creates a long-lived shared credential in the Function App configuration.
RISK-006 High
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The staging-slot template stores a listKeys() storage credential in WEBSITE_CONTENTAZUREFILECONNECTIONSTRING. Slot configuration readers can recover and reuse that account key.
RISK-007 High
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The staging slot receives AzureWebJobsStorage as a shared-key connection string. This exposes a reusable storage credential through application settings.
RISK-008 High
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The Bicep example calls listKeys() and embeds the storage account key in AzureWebJobsStorage. Managed identity settings would avoid placing this reusable credential in app configuration.
RISK-009 High
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The Function App content connection string contains a storage account key obtained through listKeys(). The generated application settings therefore hold a reusable shared credential.
RISK-010 High
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The AzureWebJobsStorage value embeds a listKeys() account key in the production Function App settings. This increases exposure compared with identity-based storage configuration.
RISK-011 High
Certificate/key files
{ name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING', value: 'DefaultEndpointsProtocol=https;AccountNa
The staging slot stores a storage account key inside WEBSITE_CONTENTAZUREFILECONNECTIONSTRING. Access to slot settings would disclose a credential usable outside the application.
RISK-012 High
Certificate/key files
{ name: 'AzureWebJobsStorage', value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.n
The staging AzureWebJobsStorage setting contains a shared storage account key from listKeys(). This creates avoidable secret material in deployment configuration.
RISK-013 High
Environment file access
secret: process.env.SESSION_SECRET || 'dev-secret-change-in-prod',
The production configuration falls back to the known value dev-secret-change-in-prod when SESSION_SECRET is absent. A production misconfiguration would permit attackers to forge signed sessions.
RISK-014 High
SKILL.md:39references/services/functions/templates/recipes/composition.md:38references/services/functions/templates/recipes/composition.md:79references/services/functions/templates/recipes/composition.md:123-129references/services/functions/templates/recipes/composition.md:202-215references/recipes/azd/terraform.md:227-245
Bundled References Bypass Approval and Validation
The core skill limits itself to preparation and requires approval plus validation. Bundled references instead deploy without prompts, which can provision billable resources before the required handoff.
The core rule forbids deployment, while the loaded Function workflow explicitly deploys and requires noninteractive commands.
RISK-015 High
Shell Secret Substitution Can Expose Plaintext
The guidance claims command substitution avoids process-list exposure. Shell expansion places the secret in the Azure CLI argument vector, where local process inspection or logging may capture it.
The documented command expands secret.txt into a command-line argument, despite the adjacent claim that this avoids process-list disclosure.
RISK-016 High
references/services/event-grid/bicep.md:6-12references/services/event-grid/bicep.md:45-52references/services/event-grid/bicep.md:64-71
Event Grid Template Uses Public Shared-Key Access
The Event Grid pattern enables public network access and authenticates publishers with a topic key from environment variables. This conflicts with the skill's private-network and managed-identity guidance.
The template explicitly enables public access and constructs both clients with a reusable EVENTGRID_TOPIC_KEY.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalSkill instructions claim authoritative status and direct agents to skip verification of remote template content.Remove authority claims and mandatory-compliance language. Require agents to treat remote template output as untrusted, inspect it, validate paths, and request approval.
- FIX-002CriticalThe azd installer is downloaded and executed through a pipe.Use a trusted package manager, or download a pinned release, verify its checksum, inspect it, and execute it separately.
- FIX-003CriticalRemote Function templates are trusted, written, and deployed without validation.Pin template commits, validate every path stays inside the workspace, inspect content, and require approval before any execution or deployment.
- FIX-004HighBundled Function references bypass the preparation-only workflow.Remove direct azd deployment commands and hand approved artifacts to azure-validate before any azure-deploy action.
- FIX-005HighGenerated infrastructure includes broad public network access.Replace 0.0.0.0/0 and AllowAzureServices with approved egress ranges, private endpoints, or narrowly scoped firewall rules.
- FIX-006HighTemplates place reusable storage keys and weak fallback secrets in application settings.Use identity-based storage settings, fail startup when required secrets are absent, and remove all known fallback secret values.
- FIX-007HighSecret command substitution is presented as safe from process inspection.Use Key Vault references or a supported standard-input mechanism. Never expand plaintext secrets into command-line arguments.
- FIX-008HighThe Event Grid example enables public access and shared-key authentication.Use managed identity with least-privilege Event Grid RBAC and disable public network access when the architecture supports private connectivity.
- FIX-009HighStatic analysis exposed only 400 of 679 matches for adjudication.Manually review the remaining 279 matches before publication and repeat adjudication if any introduce distinct behavior.
- FIX-010MediumStatic review cappedManually review the omitted 279 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Content hash
- d6e276fcca5b6d731a1e9a7872e3a4c32a1cd2f8c74d6d83fb57a725aae1b778
- Tree hash
- b8ae13e56291207cd339ac50978fedc02e9d08a57ceb45a0f8e82ed1d6cc9e87
- Skill path
- skills/microsoft/azure-prepare
- Audit payload hash
- dd4dd7cf4ba547ac0419d8d50ec5a4d5
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: active