Skills deploy-model

📦

deploy-model

Name: deploy-model
Author: microsoft

v1.0.0 Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access

Deploy Azure AI Models with Capacity Checks

Azure model deployment requires current availability, quota, region, and SKU data. This skill guides deployment choices, confirmation, execution, and status checks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "deploy-model" from https://skillstore.io/skills/microsoft-deploy-model.md and its manifest at https://skillstore.io/api/skills/microsoft-deploy-model/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-deploy-model.md Signed manifest GET /api/skills/microsoft-deploy-model/manifest Signed lockfile GET /api/skills/microsoft-deploy-model/lockfile

Test it

Using "deploy-model". Deploy gpt-4o-mini with defaults.

Expected outcome:

The skill confirms the subscription and project, checks capacity, selects a suitable region, and asks for approval before deployment.

Using "deploy-model". Find a region with 100K TPM for gpt-4o.

Expected outcome:

The skill returns ranked regions with capacity, quota status, available projects, and recommended next actions.

Using "deploy-model". Create a custom PTU deployment.

Expected outcome:

The skill guides version, SKU, capacity, policy, review, deployment execution, and status monitoring.

Security Audit

Critical

v5 • 7/23/2026 Open versioned report

Most static alerts are false positives from Markdown formatting, documented Azure commands, official Microsoft endpoints, and benign redirection. Confirmed risks include jq program injection through the SKU argument and a predictable temporary file. Semantic review also found local Python code injection and Azure CLI option injection.

Files scanned

2,763

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Critical

capacity/scripts/discover_and_rank.sh:53-60 capacity/scripts/discover_and_rank.sh:104

Unsanitized Inline Python Construction

The discovery helper inserts script arguments and Azure JSON directly into Python source. Crafted model, version, or capacity input can execute local Python code.

Lines 57-60 embed unescaped values inside Python string literals, while line 104 embeds model arguments inside generated Python source. These inputs can change program syntax.

High

customize/references/customize-workflow.md:61 customize/references/customize-workflow.md:317-325

Azure CLI Option Injection in Custom Workflow

The workflow permits custom model names, then expands user-influenced values as unquoted Azure CLI arguments. Whitespace can introduce extra options and redirect or disrupt deployment operations.

The instructions explicitly allow custom model input and later use unquoted Bash expansions in a resource-creating command. Bash word splitting can turn one value into additional Azure CLI options.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

capacity/scripts/query_capacity.sh:45

Shell command substitution

REGIONS_WITH_CAP=$(echo "$CAPACITY_RESULT" | jq -r ".value[] | select(.properties.skuName==\"$SKU\"

The SKU argument is interpolated directly into jq source. A crafted SKU can alter the filter and expose process environment values through jq's $ENV object.

High

capacity/scripts/query_capacity.sh:59

Shell command substitution

avail=$(echo "$CAPACITY_RESULT" | jq -r ".value[] | select(.location==\"$region\" and .properties.sk

The user-controlled SKU is inserted into a second jq program without --arg. A crafted value can execute unintended jq filters and place environment data in printed output.

Medium

preset/references/preset-workflow.md:200

Temp directory access

echo "$ALL_REGIONS_JSON" > /tmp/capacity_check.json

The workflow writes Azure response data to a fixed /tmp/capacity_check.json path. A local attacker can pre-create a symlink, causing file clobbering with the agent user's permissions.

Risk Factors

⚙️ External commands (50)

🌐 Network access (26)

capacity/scripts/discover_and_rank.ps1:26 capacity/scripts/discover_and_rank.ps1:32 capacity/scripts/discover_and_rank.sh:21 capacity/scripts/discover_and_rank.sh:27 capacity/scripts/query_capacity.ps1:41 capacity/scripts/query_capacity.ps1:43 capacity/scripts/query_capacity.sh:34 capacity/scripts/query_capacity.sh:36 customize/EXAMPLES.md:80 customize/references/customize-workflow.md:130 customize/references/customize-workflow.md:149 customize/references/customize-workflow.md:209 customize/references/customize-workflow.md:219 customize/references/customize-workflow.md:340 customize/references/customize-workflow.md:385 preset/references/preset-workflow.md:168 preset/references/preset-workflow.md:197 preset/references/preset-workflow.md:497 preset/references/preset-workflow.md:507 preset/references/preset-workflow.md:521 preset/references/preset-workflow.md:566 preset/references/workflow.md:108 preset/references/workflow.md:80 preset/references/workflow.md:93 scripts/generate_deployment_url.ps1:59 scripts/generate_deployment_url.sh:87

📁 Filesystem access (38)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-deploy-model/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-deploy-model/security.svg)](https://skillstore.io/skills/microsoft-deploy-model?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-deploy-model?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-deploy-model/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-deploy-model.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). deploy-model security audit report (audit version 5) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/microsoft-deploy-model/audits/5

BibTeX citation

@techreport{microsoft-microsoft-deploy-model-2026,
  author = {microsoft},
  title = {deploy-model security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/microsoft-deploy-model/audits/5},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "deploy-model security audit report (audit version 5)"
version: "1.0.0"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-deploy-model/audits/5"
identifiers:
  - type: other
    value: "skillstore:microsoft-deploy-model:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Deploy a model quickly

Choose a model and use current Azure data to find suitable default deployment settings.

Plan capacity across regions

Compare Azure regions and projects before selecting a model deployment target.

Configure governed deployments

Select model version, SKU, capacity, RAI policy, and upgrade behavior for controlled environments.

Try These Prompts

Quick model deployment

Deploy gpt-4o-mini to my Azure AI Foundry project with recommended defaults. Confirm the target project before creating resources.

Capacity discovery

Find regions where I can deploy gpt-4o with at least 50K TPM. Show capacity, quota, and matching projects.

Custom deployment

Deploy gpt-4o with a selected version, GlobalStandard SKU, custom capacity, and Microsoft.DefaultV2 RAI policy. Review all settings first.

Production deployment planning

Plan a production Azure AI Foundry deployment. Compare regions, SKU choices, quota limits, upgrade policy, and confirmation steps before deployment.

Best Practices

Confirm subscription, project, region, SKU, and capacity before creating resources.
Use live Azure quota and model catalog data instead of hardcoded availability lists.
Start with conservative capacity and monitor usage before increasing throughput.

Avoid

Deploying without showing the target project and subscription.
Assuming a model or SKU is available without checking live Azure data.
Selecting custom RAI policies or PTU settings without validating organizational requirements.