📦
Audit History
azure-upgrade - 6 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v6 Latest | Jul 23, 2026, 07:35 PM | 3 confirmed | 11 | No capability change |
| v5 | Jul 8, 2026, 05:05 AM | 10 confirmed | 22 | Env variables |
| v4 | Jul 6, 2026, 06:16 PM | 4 confirmed | 13 | No capability change |
| v3 | Jul 6, 2026, 06:16 PM | 4 confirmed | 13 | No capability change |
| v2 | Jun 30, 2026, 07:50 AM | No confirmed findings | 4 | External commandsNetwork accessFilesystem access |
| v1 | Mar 17, 2026, 08:23 AM | No confirmed findings | 0 | Baseline |
Audit version 6 Latest
Jul 23, 2026, 07:35 PM
Most static matches are documentation syntax, relative links, or scoped Azure checks. Confirmed risks include untrusted wrapper execution, destructive build-file handling, and credential exposure. Hidden persistent directives and unpinned external skill installation add supply-chain and agent-control risk.
31
Files scanned
3,461
Lines analyzed
18
Review items
0
False positives ignored
Confirmed security concerns (3)
High
references/services/functions/automation.md:110-111references/services/functions/automation.md:212-222
Azure Credentials Exposed by Migration Commands
The guide prints every Function App setting and passes AzureWebJobsStorage on command lines. These values can expose production credentials in logs and process listings.
The commands explicitly retrieve, print, and reuse app settings and a storage connection string. AzureWebJobsStorage is a credential-bearing setting.
High
references/languages/java/templates/PROGRESS_TEMPLATE.md:5-16references/languages/java/rules/troubleshooting.md:3-22
Prompt Injection Attempt Detected
A hidden template comment says "DON'T REMOVE THIS COMMENT BLOCK" and directs agents to continue without user input or token limits. Generated files can persist these directives.
The instructions are explicit, persistent, and hidden inside a generated project comment. They attempt to control future agent behavior and disregard operational limits.
Medium
references/services/redis/redis-to-amr.md:4-6references/services/redis/redis-to-amr.md:64-72SKILL.md:81
Unpinned External Skill Installation
Redis requests are redirected to separately maintained repositories, and users are told to install those skills. No immutable commit or reviewed package version is required.
The routing and installation instructions are explicit, but the linked repositories are external to this audited package. Their future content is outside this report.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
references/languages/java/scripts/upgrade_bom.py:195references/languages/java/scripts/upgrade_bom.py:433
Python subprocess.run · 2 occurrences
return subprocess.run(cmd, cwd=project_dir).returncode
The helper executes a detected project Maven wrapper or an unrestricted --mvn executable. A malicious wrapper or supplied executable can run arbitrary code with the agent's privileges.
High
Python file write/append
with open(yml_path, "w", encoding="utf-8") as f:
The script opens a fixed project-root rewrite.yml path with truncation and does not preserve an existing file. The cleanup later removes that same path.
High
references/languages/java/scripts/upgrade_bom.py:394references/languages/java/scripts/upgrade_bom.py:425
Python file write/append · 2 occurrences
with open(build_file, "w", encoding="utf-8") as f:
The script replaces the complete Gradle build file after regex-based injection. It performs no backup or atomic restoration if the source layout is unexpected.
High
references/languages/java/scripts/upgrade_bom.py:150references/languages/java/scripts/upgrade_bom.py:257
Python os file operations · 2 occurrences
os.chmod(wrapper, mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
The script grants execute permission to a project-provided Maven wrapper before running it. This can activate untrusted repository code without a trust check.
High
Python os file operations
os.remove(yml_path)
The script removes project-root rewrite.yml after overwriting that fixed path. An existing user file is therefore destroyed rather than restored.
High
Shell command substitution
app_settings=$(az functionapp config appsettings list --name $appName --resource-group $rgName)
The command captures all Function App settings, and the next line prints them. App settings commonly contain connection strings, tokens, and other secrets.
High
Shell command substitution
storageConnection=$(az functionapp config appsettings list --name $appName --resource-group $rgName
The command extracts AzureWebJobsStorage into a shell variable. The guide later passes that connection string on command lines, exposing a storage credential.
High
Shell command substitution
packageName=$(az storage blob list --connection-string $storageConnection --container-name scm-relea
The command passes the storage connection string as an unquoted process argument while querying blobs. This can expose credentials through process inspection and shell expansion.
Risk Factors
⚙️ External commands (49)
references/languages/java/bom-migration/bom-gradle.md:12 references/languages/java/bom-migration/bom-gradle.md:121 references/languages/java/bom-migration/bom-gradle.md:122 references/languages/java/bom-migration/bom-maven.md:12 references/languages/java/bom-migration/bom-maven.md:111 references/languages/java/bom-migration/bom-migration.md:9 references/languages/java/bom-migration/bom-migration.md:15 references/languages/java/bom-migration/bom-migration.md:17 references/languages/java/bom-migration/bom-migration.md:31 references/languages/java/INSTRUCTION.md:17 references/languages/java/INSTRUCTION.md:19 references/languages/java/INSTRUCTION.md:25 references/languages/java/INSTRUCTION.md:82 references/languages/java/INSTRUCTION.md:84 references/languages/java/scripts/upgrade_bom.py:195 references/languages/java/scripts/upgrade_bom.py:433 references/languages/java/scripts/upgrade_bom.py:371 references/services/functions/automation.md:139-143 references/services/functions/automation.md:110 references/services/functions/automation.md:152-153 references/services/functions/automation.md:164-165 references/services/functions/automation.md:169 references/services/functions/automation.md:171 references/services/functions/automation.md:213-214 references/services/functions/automation.md:217-218 references/services/functions/automation.md:354-355 references/services/functions/automation.md:357 references/services/functions/automation.md:4 references/services/functions/automation.md:57 references/services/functions/automation.md:68 references/services/functions/consumption-to-flex.md:47 references/services/redis/redis-to-amr.md:10 references/services/redis/redis-to-amr.md:25 references/services/redis/redis-to-amr.md:33 references/services/redis/redis-to-amr.md:44 references/services/redis/redis-to-amr.md:54 SKILL.md:13 SKILL.md:32 SKILL.md:33 SKILL.md:43 SKILL.md:49 SKILL.md:55 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:68 SKILL.md:70 SKILL.md:90 SKILL.md:91
🔑 Env variables (4)
references/languages/java/package-specific/com.microsoft.azure.management.md:21 references/languages/java/package-specific/com.microsoft.azure.management.md:25 references/languages/java/package-specific/com.microsoft.azure.management.md:21 references/languages/java/package-specific/com.microsoft.azure.management.md:61
📁 Filesystem access (14)
references/languages/java/rules/upgrade-strategy.md:7 references/languages/java/scripts/upgrade_bom.py:331 references/languages/java/scripts/upgrade_bom.py:394 references/languages/java/scripts/upgrade_bom.py:425 references/languages/java/scripts/upgrade_bom.py:150 references/languages/java/scripts/upgrade_bom.py:257 references/languages/java/scripts/upgrade_bom.py:460 references/languages/java/workflow/phase-1-precheck.md:3 references/languages/java/workflow/phase-2-plan.md:3 references/languages/java/workflow/phase-3-execute.md:3 references/languages/java/workflow/phase-3-execute.md:24 references/languages/java/workflow/phase-4-summarize.md:3 references/services/functions/automation.md:357 references/services/functions/automation.md:375
🌐 Network access (8)
references/languages/java/scripts/upgrade_bom.py:40 references/languages/java/scripts/upgrade_bom.py:82 references/languages/java/scripts/upgrade_bom.py:45 references/languages/java/scripts/upgrade_bom.py:46 references/languages/java/scripts/upgrade_bom.py:169 references/services/functions/automation.md:357 references/services/functions/automation.md:375 SKILL.md:81
Audited by: codex
Jul 8, 2026, 05:05 AM
Most static findings are documentation-only false positives, especially PowerShell mentions, Markdown links, and inline code formatting. Confirmed risks remain in executable migration helpers and Azure CLI guidance, including build-tool execution, project file mutation, network fetches, sensitive configuration exposure, and overbroad autonomous workflow language.
31
Files scanned
3,461
Lines analyzed
36
Review items
0
False positives ignored
Confirmed security concerns (10)
High
references/languages/java/templates/PROGRESS_TEMPLATE.md:15-27references/languages/java/rules/troubleshooting.md:7-20references/languages/java/workflow/phase-2-plan.md:40-44
Overbroad Agent Autonomy Instructions
The Java workflow tells the agent to avoid pausing, treats token and time limits as invalid, and proceeds directly to execution. These instructions can conflict with host limits, user confirmation, and safe scope control.
The cited text directly imposes no-pause and no-stop behavior. It does not claim system authority, but it can override user or host boundaries.
High
references/languages/java/scripts/upgrade_bom.py:300-333references/languages/java/scripts/upgrade_bom.py:459-463
Project Configuration Overwrite and Deletion Risk
The BOM helper writes rewrite.yml in the project root and later removes that path. A preexisting OpenRewrite configuration can be overwritten or deleted.
The code constructs a fixed rewrite.yml path, writes it, and removes it during cleanup. There is no check, backup, or restore for an existing user file.
High
references/services/functions/automation.md:109-111references/services/functions/automation.md:212-218
Sensitive Azure Configuration Disclosure
The automation guidance collects and prints app settings, then reads the AzureWebJobsStorage connection string for storage access. These values commonly contain secrets.
The cited commands explicitly collect app settings and a storage connection string. Azure app settings commonly include credentials and tokens.
Medium
System reconnaissance
- **NO premature termination**: Token limits, time constraints, or complexity are NEVER valid reason
The mandatory rule says token limits, time constraints, and complexity are never valid reasons to stop. This is not reconnaissance, but it is a real prompt-control risk.
Medium
System reconnaissance
- **NO categorical dismissals**: "Test-specific issues", "doesn't affect production", "sample/demo c
The rule forbids categorical dismissals of failures. It can override normal risk triage in edge cases, so it is kept as a low-confidence control risk.
Medium
System reconnaissance
- **Genuine limitations ONLY**: A limitation is valid ONLY if: (1) multiple distinct fix approaches
The rule allows limitations only after exhaustive attempts. That can conflict with practical stopping criteria and user-directed scope limits.
Medium
System reconnaissance
- **Do NOT treat partial migration as acceptable.** Migrating some files but not others is not a val
The rule forbids partial migration as a stopping point. In a marketplace skill, this can push broad code modification beyond the user-approved scope.
Medium
System reconnaissance
- **NO premature termination**: Token limits, time constraints, or complexity are NEVER valid reason
The template says token limits, time constraints, and complexity are never valid reasons to skip fixing. This can pressure an agent to ignore operational limits.
Medium
System reconnaissance
- **NO categorical dismissals**: "Test-specific issues", "doesn't affect production", "sample/demo c
The template forbids dismissing failing tests as non-production or sample issues. This can be useful quality guidance, but it also reduces safe stopping discretion.
Medium
Unquoted Deployment Package Filename
The package name returned from blob storage is used unquoted as the local output file path. Blob names with spaces, option-like prefixes, or path separators can cause unintended behavior.
The package name comes from remote blob metadata and is expanded unquoted in a shell command. This creates plausible parsing and file path risks.
Capability review items (22)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
references/languages/java/scripts/upgrade_bom.py:195references/languages/java/scripts/upgrade_bom.py:433
Python subprocess.run · 2 occurrences
return subprocess.run(cmd, cwd=project_dir).returncode
The script runs Maven and OpenRewrite in the target project. Even without shell=True, project build tools can execute project-controlled plugins and scripts.
High
Python file write/append
with open(yml_path, "w", encoding="utf-8") as f:
The script writes rewrite.yml in the target project without preserving a preexisting file. Cleanup later can remove the same generic project file.
High
Python os file operations
os.remove(yml_path)
The script deletes rewrite.yml during cleanup. Because the name is generic, an existing user OpenRewrite configuration could be removed.
High
Shell command substitution
app_settings=$(az functionapp config appsettings list --name $appName --resource-group $rgName)
The script reads all Function App settings and then prints them. App settings often contain secrets, connection strings, or tokens.
High
Shell command substitution
storageConnection=$(az functionapp config appsettings list --name $appName --resource-group $rgName
The script reads AzureWebJobsStorage into a shell variable. This value is a credential-bearing connection string and may be exposed through logs or shell state.
High
Shell command substitution
packageName=$(az storage blob list --connection-string $storageConnection --container-name scm-relea
The script uses the storage connection string to list deployment packages. It combines credential use with unquoted shell variables in runnable guidance.
Medium
references/languages/java/scripts/upgrade_bom.py:394references/languages/java/scripts/upgrade_bom.py:425
Python file write/append · 2 occurrences
with open(build_file, "w", encoding="utf-8") as f:
The script rewrites the Gradle build file to inject OpenRewrite configuration. This directly modifies project build configuration and can corrupt it if assumptions fail.
Medium
references/languages/java/scripts/upgrade_bom.py:150references/languages/java/scripts/upgrade_bom.py:257
Python os file operations · 2 occurrences
os.chmod(wrapper, mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
The script changes executable bits on mvnw in the target project. This is intended wrapper handling but still mutates project file permissions.
Medium
Shell command substitution
systemUserId=$(az functionapp identity show --name $appName --resource-group $rgName \
The script enumerates system-assigned managed identity principal IDs. This is read-only but exposes cloud identity metadata.
Medium
Shell command substitution
userIdentities=$(az functionapp identity show --name $appName --resource-group $rgName \
The script enumerates user-assigned managed identities. This is legitimate assessment work but reveals cloud identity metadata.
Medium
Shell command substitution
echo "User-assigned identity: $(echo "$identity" | jq -r '.key' | sed 's|.*/userAssignedIdentities/|
The loop prints user-assigned identity names derived from resource IDs. This can disclose identity inventory during migration.
Medium
Shell command substitution
az role assignment list --assignee $(echo "$identity" | jq -r '.value.principalId') --all --output j
The script lists all role assignments for each identity principal. RBAC enumeration can reveal privilege paths and should be handled carefully.
Medium
Shell command substitution
DEFAULT_HOST=$(az functionapp show --name <NEW_APP_NAME> --resource-group <RESOURCE_GROUP> \
The script discovers the migrated app default hostname for validation. This is low-impact cloud resource discovery but still executes Azure CLI.
Medium
Shell command substitution
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST")
The script performs an HTTP smoke test against the migrated app. This is legitimate validation but calls a live endpoint.
Medium
Hardcoded URL
curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST/api/<FUNCTION_NAME>"
The curl command can invoke a live HTTP trigger endpoint. If the function is not idempotent, validation may have side effects.
Low
Python HTTP libraries
import urllib.request
The imported urllib module is used by the same script to fetch BOM metadata from GitHub. This is an external network dependency that influences migration output.
Low
Python HTTP libraries
with urllib.request.urlopen(BOM_POM_URL, timeout=HTTP_TIMEOUT_SECONDS) as response:
The script downloads the Azure SDK BOM POM from GitHub to select a version. The fetch is legitimate but remote content affects dependency rewrites.
Low
Hardcoded URL
BOM_POM_URL = "https://raw.githubusercontent.com/Azure/azure-sdk-for-java/main/sdk/boms/azure-sdk-bo
The hardcoded raw.githubusercontent.com URL is fetched for BOM data. A remote source controls version selection, so integrity and availability matter.
Low
Hardcoded URL
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST")
The curl command sends a request to the app hostname. The URL is dynamic, but the line still performs a network call to a live Azure endpoint.
Risk Factors
⚙️ External commands (49)
references/languages/java/bom-migration/bom-gradle.md:12 references/languages/java/bom-migration/bom-gradle.md:121 references/languages/java/bom-migration/bom-gradle.md:122 references/languages/java/bom-migration/bom-maven.md:12 references/languages/java/bom-migration/bom-maven.md:111 references/languages/java/bom-migration/bom-migration.md:9 references/languages/java/bom-migration/bom-migration.md:15 references/languages/java/bom-migration/bom-migration.md:17 references/languages/java/bom-migration/bom-migration.md:31 references/languages/java/INSTRUCTION.md:17 references/languages/java/INSTRUCTION.md:19 references/languages/java/INSTRUCTION.md:25 references/languages/java/INSTRUCTION.md:82 references/languages/java/INSTRUCTION.md:84 references/languages/java/scripts/upgrade_bom.py:195 references/languages/java/scripts/upgrade_bom.py:433 references/languages/java/scripts/upgrade_bom.py:371 references/services/functions/automation.md:139-143 references/services/functions/automation.md:110 references/services/functions/automation.md:152-153 references/services/functions/automation.md:164-165 references/services/functions/automation.md:169 references/services/functions/automation.md:171 references/services/functions/automation.md:213-214 references/services/functions/automation.md:217-218 references/services/functions/automation.md:354-355 references/services/functions/automation.md:357 references/services/functions/automation.md:4 references/services/functions/automation.md:57 references/services/functions/automation.md:68 references/services/functions/consumption-to-flex.md:47 references/services/redis/redis-to-amr.md:10 references/services/redis/redis-to-amr.md:25 references/services/redis/redis-to-amr.md:33 references/services/redis/redis-to-amr.md:44 references/services/redis/redis-to-amr.md:54 SKILL.md:13 SKILL.md:32 SKILL.md:33 SKILL.md:43 SKILL.md:49 SKILL.md:55 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:68 SKILL.md:70 SKILL.md:90 SKILL.md:91
🔑 Env variables (4)
references/languages/java/package-specific/com.microsoft.azure.management.md:21 references/languages/java/package-specific/com.microsoft.azure.management.md:25 references/languages/java/package-specific/com.microsoft.azure.management.md:21 references/languages/java/package-specific/com.microsoft.azure.management.md:61
📁 Filesystem access (14)
references/languages/java/rules/upgrade-strategy.md:7 references/languages/java/scripts/upgrade_bom.py:331 references/languages/java/scripts/upgrade_bom.py:394 references/languages/java/scripts/upgrade_bom.py:425 references/languages/java/scripts/upgrade_bom.py:150 references/languages/java/scripts/upgrade_bom.py:257 references/languages/java/scripts/upgrade_bom.py:460 references/languages/java/workflow/phase-1-precheck.md:3 references/languages/java/workflow/phase-2-plan.md:3 references/languages/java/workflow/phase-3-execute.md:3 references/languages/java/workflow/phase-3-execute.md:24 references/languages/java/workflow/phase-4-summarize.md:3 references/services/functions/automation.md:357 references/services/functions/automation.md:375
🌐 Network access (8)
references/languages/java/scripts/upgrade_bom.py:40 references/languages/java/scripts/upgrade_bom.py:82 references/languages/java/scripts/upgrade_bom.py:45 references/languages/java/scripts/upgrade_bom.py:46 references/languages/java/scripts/upgrade_bom.py:169 references/services/functions/automation.md:357 references/services/functions/automation.md:375 SKILL.md:81
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissance
Audited by: codex
Jul 6, 2026, 06:16 PM
Most static findings are Markdown formatting false positives or expected Azure migration inventory. Confirmed risks are operational: Azure CLI commands collect app settings, identity and RBAC metadata, deployment packages, hostnames, and validation endpoints. No prompt injection, malicious exfiltration intent, or hidden override instructions were found in the reviewed files.
6
Files scanned
955
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (4)
Low
System reconnaissance
# Find blob triggers NOT using EventGrid source
The section instructs the user to enumerate blob trigger configuration for compatibility. It is authorized migration assessment, but it is still cloud resource reconnaissance.
Low
System reconnaissance
az functionapp config hostname list --webapp-name $appName --resource-group $rgName \
The Azure CLI command lists custom hostnames on the Function App. This inventory is valid for migration, but it reveals externally reachable names.
Low
System reconnaissance
az functionapp config hostname list --webapp-name <NEW_APP_NAME> --resource-group <RESOURCE_GROUP> \
The command verifies custom hostnames on the new app after migration. It is legitimate validation, but it performs resource inventory through Azure CLI.
Low
System reconnaissance
1. **Smoke test** — Get the app’s default hostname via `az functionapp show --query defaultHostName
The step instructs the agent to retrieve the default hostname and test reachability. That is normal validation, but it reveals endpoint information and uses external commands.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
--query "[?contains(name, 'azurewebsites.net')==\`false\`]" --output table
The line is part of an Azure CLI query that enumerates custom hostnames for a Function App. It is legitimate migration work, but it performs cloud resource inventory through external commands.
Medium
Shell command substitution
app_settings=$(az functionapp config appsettings list --name $appName --resource-group $rgName)
The command captures all Function App settings into a shell variable and prints them later. App settings may include connection strings or secrets, so this is a real sensitive data handling risk.
Medium
Shell command substitution
systemUserId=$(az functionapp identity show --name $appName --resource-group $rgName \
The command queries managed identity metadata from Azure and stores it for role assignment checks. This is authorized migration inventory, but it still exposes identity identifiers through shell execution.
Medium
Shell command substitution
userIdentities=$(az functionapp identity show --name $appName --resource-group $rgName \
The command retrieves user-assigned managed identity data from Azure. It is valid upgrade preparation, but it gathers identity metadata that should be handled carefully.
Medium
Shell command substitution
echo "User-assigned identity: $(echo "$identity" | jq -r '.key' | sed 's|.*/userAssignedIdentities/|
The command parses managed identity resource IDs with jq and sed inside command substitution. It is not malicious, but unquoted shell processing around cloud identity data is an operational risk.
Medium
Shell command substitution
az role assignment list --assignee $(echo "$identity" | jq -r '.value.principalId') --all --output j
The command lists role assignments for managed identities. This is expected for migration, but it enumerates RBAC permissions and can reveal sensitive authorization structure.
Medium
Shell command substitution
storageConnection=$(az functionapp config appsettings list --name $appName --resource-group $rgName
The command extracts the AzureWebJobsStorage connection string from app settings. That value is sensitive and can grant storage access if exposed.
Medium
Shell command substitution
packageName=$(az storage blob list --connection-string $storageConnection --container-name scm-relea
The command uses a storage connection string to list deployment packages in scm-releases. This is legitimate recovery guidance, but it accesses deployable artifacts through credentials.
Medium
Shell command substitution
DEFAULT_HOST=$(az functionapp show --name <NEW_APP_NAME> --resource-group <RESOURCE_GROUP> \
The command queries the new Function App default hostname for validation. It is benign in intent, but it still executes external Azure CLI inventory commands.
Medium
Shell command substitution
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST")
The command performs a curl request against the app hostname returned by Azure. This is expected smoke testing, but it contacts an external endpoint from the user environment.
Medium
Ruby/shell backtick execution
Track progress in `upgrade-status.md` inside the workspace root.
The skill instructs creation or updates of upgrade-status.md in the workspace root. This is expected progress tracking, but it is real workspace filesystem modification.
Low
Hardcoded URL
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST")
The curl command makes an outbound HTTPS request to the app hostname for smoke testing. The target is derived from Azure, so this is expected but still real network activity.
Low
Hardcoded URL
curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST/api/<FUNCTION_NAME>"
The curl command contacts a Function App endpoint supplied by the user workflow. This is legitimate validation, but it requires outbound network access.
Risk Factors
⚙️ External commands (26)
references/services/functions/automation.md:139-143 references/services/functions/automation.md:110 references/services/functions/automation.md:152-153 references/services/functions/automation.md:164-165 references/services/functions/automation.md:169 references/services/functions/automation.md:171 references/services/functions/automation.md:213-214 references/services/functions/automation.md:217-218 references/services/functions/automation.md:354-355 references/services/functions/automation.md:357 references/services/functions/automation.md:4 references/services/functions/automation.md:57 references/services/functions/automation.md:68 references/services/functions/consumption-to-flex.md:47 SKILL.md:12 SKILL.md:28 SKILL.md:29 SKILL.md:40 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:59 SKILL.md:61 SKILL.md:75 SKILL.md:76
🌐 Network access (2)
📁 Filesystem access (2)
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissance
Audited by: codex
Jul 6, 2026, 06:16 PM
Most static findings are Markdown formatting false positives or expected Azure migration inventory. Confirmed risks are operational: Azure CLI commands collect app settings, identity and RBAC metadata, deployment packages, hostnames, and validation endpoints. No prompt injection, malicious exfiltration intent, or hidden override instructions were found in the reviewed files.
6
Files scanned
955
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (4)
Low
System reconnaissance
# Find blob triggers NOT using EventGrid source
The section instructs the user to enumerate blob trigger configuration for compatibility. It is authorized migration assessment, but it is still cloud resource reconnaissance.
Low
System reconnaissance
az functionapp config hostname list --webapp-name $appName --resource-group $rgName \
The Azure CLI command lists custom hostnames on the Function App. This inventory is valid for migration, but it reveals externally reachable names.
Low
System reconnaissance
az functionapp config hostname list --webapp-name <NEW_APP_NAME> --resource-group <RESOURCE_GROUP> \
The command verifies custom hostnames on the new app after migration. It is legitimate validation, but it performs resource inventory through Azure CLI.
Low
System reconnaissance
1. **Smoke test** — Get the app’s default hostname via `az functionapp show --query defaultHostName
The step instructs the agent to retrieve the default hostname and test reachability. That is normal validation, but it reveals endpoint information and uses external commands.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
--query "[?contains(name, 'azurewebsites.net')==\`false\`]" --output table
The line is part of an Azure CLI query that enumerates custom hostnames for a Function App. It is legitimate migration work, but it performs cloud resource inventory through external commands.
Medium
Shell command substitution
app_settings=$(az functionapp config appsettings list --name $appName --resource-group $rgName)
The command captures all Function App settings into a shell variable and prints them later. App settings may include connection strings or secrets, so this is a real sensitive data handling risk.
Medium
Shell command substitution
systemUserId=$(az functionapp identity show --name $appName --resource-group $rgName \
The command queries managed identity metadata from Azure and stores it for role assignment checks. This is authorized migration inventory, but it still exposes identity identifiers through shell execution.
Medium
Shell command substitution
userIdentities=$(az functionapp identity show --name $appName --resource-group $rgName \
The command retrieves user-assigned managed identity data from Azure. It is valid upgrade preparation, but it gathers identity metadata that should be handled carefully.
Medium
Shell command substitution
echo "User-assigned identity: $(echo "$identity" | jq -r '.key' | sed 's|.*/userAssignedIdentities/|
The command parses managed identity resource IDs with jq and sed inside command substitution. It is not malicious, but unquoted shell processing around cloud identity data is an operational risk.
Medium
Shell command substitution
az role assignment list --assignee $(echo "$identity" | jq -r '.value.principalId') --all --output j
The command lists role assignments for managed identities. This is expected for migration, but it enumerates RBAC permissions and can reveal sensitive authorization structure.
Medium
Shell command substitution
storageConnection=$(az functionapp config appsettings list --name $appName --resource-group $rgName
The command extracts the AzureWebJobsStorage connection string from app settings. That value is sensitive and can grant storage access if exposed.
Medium
Shell command substitution
packageName=$(az storage blob list --connection-string $storageConnection --container-name scm-relea
The command uses a storage connection string to list deployment packages in scm-releases. This is legitimate recovery guidance, but it accesses deployable artifacts through credentials.
Medium
Shell command substitution
DEFAULT_HOST=$(az functionapp show --name <NEW_APP_NAME> --resource-group <RESOURCE_GROUP> \
The command queries the new Function App default hostname for validation. It is benign in intent, but it still executes external Azure CLI inventory commands.
Medium
Shell command substitution
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST")
The command performs a curl request against the app hostname returned by Azure. This is expected smoke testing, but it contacts an external endpoint from the user environment.
Medium
Ruby/shell backtick execution
Track progress in `upgrade-status.md` inside the workspace root.
The skill instructs creation or updates of upgrade-status.md in the workspace root. This is expected progress tracking, but it is real workspace filesystem modification.
Low
Hardcoded URL
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST")
The curl command makes an outbound HTTPS request to the app hostname for smoke testing. The target is derived from Azure, so this is expected but still real network activity.
Low
Hardcoded URL
curl -s -o /dev/null -w "%{http_code}" "https://$DEFAULT_HOST/api/<FUNCTION_NAME>"
The curl command contacts a Function App endpoint supplied by the user workflow. This is legitimate validation, but it requires outbound network access.
Risk Factors
⚙️ External commands (26)
references/services/functions/automation.md:139-143 references/services/functions/automation.md:110 references/services/functions/automation.md:152-153 references/services/functions/automation.md:164-165 references/services/functions/automation.md:169 references/services/functions/automation.md:171 references/services/functions/automation.md:213-214 references/services/functions/automation.md:217-218 references/services/functions/automation.md:354-355 references/services/functions/automation.md:357 references/services/functions/automation.md:4 references/services/functions/automation.md:57 references/services/functions/automation.md:68 references/services/functions/consumption-to-flex.md:47 SKILL.md:12 SKILL.md:28 SKILL.md:29 SKILL.md:40 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:59 SKILL.md:61 SKILL.md:75 SKILL.md:76
🌐 Network access (2)
📁 Filesystem access (2)
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissance
Audited by: codex
Jun 30, 2026, 07:50 AM
Static command-execution findings are mostly true in context: this skill is documentation that instructs an AI agent to generate and run Azure CLI, curl, and deployment commands. I found no prompt-injection attempt or confirmed malicious exfiltration, but the skill can create, modify, deploy, download packages from, and delete Azure resources, so it should not be published without stronger execution safeguards.
6
Files scanned
955
Lines analyzed
7
Review items
2
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
references/services/functions/automation.md:231-238references/services/functions/automation.md:322-332references/services/functions/automation.md:402-407references/services/functions/automation.md:415-420
Agent-Guided Azure Resource Modification and Deletion
The skill guides execution of Azure CLI commands that create a new function app, deploy code, restart apps, and delete function apps. The documents include confirmation language, but marketplace use would still expose users to high-impact cloud changes if an agent executes the steps with broad Azure permissions.
The referenced lines contain concrete Azure CLI commands for migration, deployment, restart, and deletion. The intent is legitimate Azure upgrade automation, but the operational impact is clearly high.
High
references/services/functions/automation.md:109-111references/services/functions/automation.md:151-171references/services/functions/automation.md:212-222
Sensitive Configuration and Package Retrieval
The automation guide collects app settings, reads AzureWebJobsStorage, lists managed identity role assignments, and downloads a deployment package using a storage connection string. These steps can expose secrets or proprietary application code in the workspace or command output.
The commands directly retrieve app settings, identity data, and deployment packages. This is expected for migration work, but it creates real exposure risk if logs or files are mishandled.
Medium
SKILL.md:57references/services/functions/automation.md:352-358references/services/functions/automation.md:371-375references/services/functions/consumption-to-flex.md:139-141
Network Calls to User Workload Endpoints
The skill instructs the agent to call the default Azure Functions hostname and HTTP trigger endpoints with curl. This is a normal validation step, but it can contact production endpoints and may trigger application behavior.
The curl commands and validation step are explicit. The risk depends on the target app behavior, so this is moderate rather than inherently malicious.
Medium
SKILL.md:61references/workflow-details.md:17-19references/services/functions/assessment.md:22-28references/services/functions/automation.md:220-222
Local Workspace File Creation for Upgrade Artifacts
The skill requires creating status and assessment files in the workspace and can download a deployment package. This is useful for migration tracking, but it may persist sensitive configuration or application artifacts locally.
The files and downloaded package are specifically named. The sensitivity depends on what values the agent writes into reports or package files.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
SKILL.md:12references/global-rules.md:26-39references/workflow-details.md:9-13references/services/functions/assessment.md:30-117
Static Weak-Crypto and Backtick Hits Are Markdown False Positives
Many weak cryptography and Ruby backtick findings map to Markdown emphasis, diagrams, inline code, Azure SKU names, or shell examples. I found no executable Ruby code, hidden cryptographic implementation, or prompt-injection instruction in the reviewed files.
The lines are documentation constructs or code-fenced templates, not executable skill code. The broader command examples remain risky, but these specific pattern classes are false positives.
Low
references/services/functions/automation.md:6references/services/functions/automation.md:317-318references/services/functions/consumption-to-flex.md:223-227
Hardcoded Documentation URLs Are Benign References
The hardcoded URLs point to Microsoft Learn and Azure sample documentation. I did not find evidence that the skill sends user data or secrets to those URLs.
The URLs are cited as documentation links, not request targets for collected data. Network activity in the skill comes from Azure CLI and curl validation commands instead.
Risk Factors
⚙️ External commands (6)
🌐 Network access (4)
Detected Patterns
Cloud Command Execution InstructionsSecret-Bearing Configuration CollectionProduction Endpoint Probing
Audited by: codex
Mar 17, 2026, 08:23 AM
This is an official Microsoft skill providing Azure upgrade documentation. The static scanner detected patterns in markdown code examples - these are FALSE POSITIVES. The skill contains documentation with example Azure CLI commands, not executable code. All detected external_commands, network, and filesystem patterns are in documentation context. No actual code execution occurs - the skill provides guidance to Claude for helping users perform legitimate Azure upgrades.
6
Files scanned
955
Lines analyzed
0
Review items
7
False positives ignored
Static false positives ignored (7)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Critical
False Positive: Code Execution + Network + Credential Access Heuristic
The static scanner flagged a CRITICAL heuristic for 'suspicious behavior patterns' (code execution + network + credential access). This is a FALSE POSITIVE - the skill is legitimate Microsoft documentation that describes Azure CLI commands for performing upgrades. The 'code execution' is bash/PowerShell examples in markdown documentation, 'network' is Azure API calls made by user-approved Azure CLI operations, and there is no credential exfiltration - the skill uses official Azure MCP tools for authenticated operations.
This is an official Microsoft skill from the azure-skills repository. The detected patterns are documentation code blocks, not actual code execution. Azure operations are performed through official MCP tools with user authentication.
High
references/services/functions/automation.md:4references/services/functions/automation.md:57references/services/functions/automation.md:68references/services/functions/consumption-to-flex.md:47
False Positive: PowerShell Invocation Detection
Static scanner flagged 'PowerShell invocation' at multiple locations in automation.md and consumption-to-flex.md. These are FALSE POSITIVES - the findings are detecting PowerShell syntax in markdown documentation code blocks, not actual PowerShell execution. The skill provides example commands for users to run in their own Azure Cloud Shell.
These are documentation code blocks in markdown files - the skill is a documentation reference, not executable code. Users run these commands themselves in their Azure environment.
High
False Positive: Weak Cryptographic Algorithm Detection
Static scanner flagged 'Weak cryptographic algorithm' at various locations in global-rules.md, automation.md, consumption-to-flex.md, workflow-details.md, and SKILL.md. These are FALSE POSITIVES - the scanner is likely triggered by text mentioning hash functions or authentication methods in documentation context. The skill promotes identity-based authentication (managed identity, DefaultAzureCredential) as documented in global-rules.md.
The skill explicitly advocates for managed identity over connection strings. These findings are triggered by documentation text mentioning authentication concepts, not actual weak cryptography implementation.
Medium
references/services/functions/automation.md:10-20references/services/functions/automation.md:110references/services/functions/consumption-to-flex.md:25-27SKILL.md:28-29
False Positive: Shell Command Detection in Documentation
Static scanner flagged 207 'Ruby/shell backtick execution' and 'Shell command substitution' findings across multiple files. These are FALSE POSITIVES - the findings are triggered by code blocks (backtick fences) in markdown documentation describing Azure CLI commands. The skill does not execute any commands - it provides documentation and guidance.
All 207 findings are in markdown documentation files. The skill uses markdown code fences to display example Azure CLI commands. No actual shell execution occurs - these are documentation examples for users to follow.
Medium
False Positive: Network Hardcoded URL Detection
Static scanner flagged 'Hardcoded URL' findings at various locations. These are FALSE POSITIVES - the URLs point to official Microsoft Learn documentation (learn.microsoft.com), which is expected for an official Microsoft skill.
The hardcoded URLs are legitimate Microsoft Learn documentation links. This is expected and appropriate for an official Microsoft skill.
Medium
False Positive: Filesystem Detection
Static scanner flagged 'Standard device file access' at locations in automation.md. These are FALSE POSITIVES - the findings are triggered by documentation text about file paths and logs, not actual filesystem operations.
These are documentation references to log files and output paths in example commands. No actual filesystem operations occur - the skill is documentation-only.
Low
False Positive: System Reconnaissance Detection
Static scanner flagged 'System reconnaissance' findings at various locations. These are FALSE POSITIVES - the skill documents how to assess Azure resources (list apps, check compatibility) which is a legitimate upgrade assessment workflow, not system reconnaissance.
These findings are triggered by documentation describing Azure resource queries (list apps, check settings). This is standard Azure administration for upgrade assessment, not malicious reconnaissance.
No confirmed security findings were recorded for this completed audit.
Audited by: claude