Skills azure-validate

📦

azure-validate

Name: azure-validate
Author: microsoft

v0.0.0-placeholder Content revision r2 Critical ⚙️ External commands📁 Filesystem access🌐 Network access

Validate Azure Deployments Before Release

Azure deployment failures often begin with missed configuration, policy, identity, or infrastructure issues. This skill runs structured readiness checks and records evidence before resources are deployed.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "azure-validate" from https://skillstore.io/skills/microsoft-azure-validate.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-validate/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-azure-validate.md Signed manifest GET /api/skills/microsoft-azure-validate/manifest Signed lockfile GET /api/skills/microsoft-azure-validate/lockfile

Test it

Using "azure-validate". Check whether this Bicep project is ready for a subscription deployment.

Expected outcome:

Deployment method: Bicep at subscription scope.
Passed: template compilation and Azure authentication.
Blocked: policy validation requires a confirmed subscription and region.
Next action: confirm target values before continuing.

Using "azure-validate". Review this Terraform project after a failed validation.

Expected outcome:

Formatting passed, but validation found a dependency cycle between the frontend and API resources.
The current CORS and application URL references depend on each other.
Use a restricted external origin value, then rerun validation and planning.

Using "azure-validate". Validate an AZD project that contains .NET Aspire and Azure Functions.

Expected outcome:

The project uses Aspire, Azure Functions, and identity-based host storage.
Function secret file storage is not configured in the AppHost.
Add the required setting, review the change, and repeat the pre-provisioning checks.

Security Audit

Critical

v5 • 7/23/2026 Open versioned report

All 56 static findings are false positives caused by Markdown formatting, relative documentation links, expected Azure checks, or project-local plan paths. Semantic review found a critical authority injection, high-risk execution of repository-defined builds, and a medium-risk wildcard CORS workaround.

Files scanned

1,301

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

SKILL.md:12 SKILL.md:52-65

Prompt Injection Attempt Detected

The skill states "AUTHORITATIVE GUIDANCE" and claims it is "the officially verified way" before requiring an azure-deploy invocation. These authority claims pressure the agent to accept unverified instructions and trigger deployment beyond a validation request.

The source contains explicit authority language and a mandatory downstream deployment action. Both behaviors match the stated prompt-injection indicators.

High

references/recipes/azcli/README.md:89-105 references/recipes/azd/README.md:123-148

Untrusted Project Build Execution

The workflow directs the agent to build Dockerfiles and run AZD packaging for repository-controlled projects. Build definitions and package hooks can execute untrusted commands with the agent's local credentials and network access.

The cited instructions explicitly execute repository-defined Docker and packaging workflows. Such workflows commonly execute project-controlled build commands.

Medium

references/recipes/terraform/errors.md:45-64

Temporary Wildcard CORS Exposure

A Terraform workaround permits a wildcard CORS origin during an initial deployment. Failures before the required follow-up can leave the API accessible from arbitrary web origins.

The example explicitly sets the allowed origin to a wildcard before a later correction. The warning reduces intent risk but does not prevent an interrupted deployment.

Risk Factors

⚙️ External commands (24)

📁 Filesystem access (8)

references/aspire-functions-secrets.md:32 references/recipes/azcli/README.md:110 references/recipes/azd/aspire.md:25 references/recipes/azd/errors.md:29 references/recipes/azd/README.md:88 references/recipes/azd/README.md:152 references/recipes/bicep/README.md:80 references/recipes/terraform/README.md:100

🌐 Network access (2)

references/recipes/terraform/errors.md:30 references/recipes/terraform/errors.md:38

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-azure-validate/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-validate/security.svg)](https://skillstore.io/skills/microsoft-azure-validate?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-azure-validate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-validate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-validate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). azure-validate security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-validate/audits/5

BibTeX citation

@techreport{microsoft-microsoft-azure-validate-2026,
  author = {microsoft},
  title = {azure-validate security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/microsoft-azure-validate/audits/5},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-validate security audit report (audit version 5)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-validate/audits/5"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-validate:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Standardize Release Gates

Apply repeatable validation checklists across Azure projects before approving a deployment.

Diagnose Deployment Blockers

Find schema, build, infrastructure, environment, and packaging problems before a release attempt.

Review Identity and Policy

Check infrastructure code for least-privilege roles and organizational policy conflicts.

Try These Prompts

Check Project Readiness

Inspect this Azure project for deployment readiness. Identify its deployment method, run only non-mutating checks, and summarize blockers before proposing any changes.

Validate a Bicep Deployment

Validate ./infra/main.bicep and its parameters. Compile the template, run the correct scope validation and what-if preview, then explain every failure.

Audit Terraform and RBAC

Review the Terraform deployment in ./infra. Check initialization, formatting, validation, plan output, backend access, variables, policies, and least-privilege RBAC assignments.

Run an AZD Aspire Preflight

Audit this AZD and .NET Aspire project end to end. Inspect azure.yaml, build prerequisites, Functions secret storage, Container Apps values, policies, and RBAC. Do not deploy. Ask before any mutating or repository-defined command.

Best Practices

Review proposed commands and confirm subscription and region before running Azure checks.
Use least-privilege credentials and isolate builds when reviewing untrusted repositories.
Record each command, result, failure, and approved fix in the deployment plan.

Avoid

Do not treat a successful syntax check as proof that runtime permissions are correct.
Do not run deployment, provisioning, package, or build commands without user approval and repository review.
Do not use wildcard CORS or broad RBAC roles as temporary production fixes.