Versioned security assessment
Report ID: SA-1200D2F8
7/8/2026, 5:36:07 AM
microsoft-foundry security assessment v5
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- microsoft-foundry
- Version
- v5
- Maintainer
- microsoft
- Coverage
- 161 Files scanned · 21,810 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
24 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The review confirms legitimate but risky DevOps capabilities: Azure CLI, azd, PowerShell, shell execution, environment handling, Azure API calls, and local file writes. The critical static hits for jailbreak terms and Azure credential directories are false positives because they document guardrails or configuration paths rather than malicious prompt injection or credential theft. No separate semantic prompt injection, social engineering, or data-exfiltration intent was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
161 Files scanned · 21,810 Lines analyzed
418 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 6 evidence locations
Network access
May connect to external services.
Observed in 154 evidence locations
Filesystem access
May read or write local files.
Observed in 237 evidence locations
Env variables
May read values from the process environment.
Observed in 118 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 390 evidence locations
Capability review items (394)
High
Generic API/secret keys
- Use `openai.AzureOpenAI(azure_endpoint=..., api_key=..., api_version=...)`
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Python exec() function
exec(compile(source, grader_path, "exec"), namespace)
This executes Python source from a grader file with exec and compile. A malicious or untrusted grader can run arbitrary local code.
High
Python compile() for exec
exec(compile(source, grader_path, "exec"), namespace)
This executes Python source from a grader file with exec and compile. A malicious or untrusted grader can run arbitrary local code.
High
Process exec
exec(compile(source, grader_path, "exec"), namespace)
This executes Python source from a grader file with exec and compile. A malicious or untrusted grader can run arbitrary local code.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"), help="API key")
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
client, method = get_clients(base_url=args.base_url, azure_endpoint=args.endpoint, project_endpoint=
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
project_endpoint=args.project_endpoint, api_key=args.api_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"), help="API key")
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
client, method = get_clients(base_url=args.base_url, azure_endpoint=args.endpoint, project_endpoint=
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Azure credential environment variables
"AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET set."
The workflow references Azure credential environment variables. These values can grant access and must be protected from logs and prompts.
High
Generic API/secret keys
def get_clients(base_url=None, azure_endpoint=None, project_endpoint=None, api_key=None):
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
api_key = api_key or os.environ.get("AZURE_OPENAI_API_KEY")
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
if not api_key:
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
client = openai.OpenAI(base_url=base_url, api_key=api_key)
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
if api_key:
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
api_key=api_key,
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
print(" AZURE_OPENAI_ENDPOINT + AZURE_OPENAI_API_KEY")
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
project_endpoint=args.project_endpoint, api_key=args.api_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Python subprocess.run
result = subprocess.run(
This runs an external process to obtain Azure context or tokens. Command execution can expose local state or act on Azure resources.
High
Generic API/secret keys
--base-url "$BASE_URL" --api-key "$API_KEY" \
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
project_endpoint=args.project_endpoint, api_key=args.api_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
judge_key = args.judge_api_key or args.api_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
judge_client, _ = get_clients(azure_endpoint=args.judge_endpoint, api_key=judge_key)
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
elif args.judge_api_key:
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
project_endpoint=args.project_endpoint, api_key=judge_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
project_endpoint=args.project_endpoint, api_key=args.api_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"), help="API key")
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
client, method = get_clients(base_url=args.base_url, azure_endpoint=args.endpoint, project_endpoint=
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
project_endpoint=args.project_endpoint, api_key=args.api_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
def submit_sft_rest(endpoint, api_key, model, train_id, val_id, epochs=2, lr=1.0, batch_size=None, s
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
"api-key": api_key,
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"),
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
project_endpoint=args.project_endpoint, api_key=args.api_key
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
if not args.endpoint or not args.api_key:
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
result = submit_sft_rest(args.endpoint, args.api_key, args.model,
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
if not args.endpoint or not args.api_key:
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
result = submit_sft_rest(args.endpoint, args.api_key, args.model,
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
export AZURE_OPENAI_API_KEY="<your-key>"
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
client = OpenAI(base_url=os.environ["OPENAI_BASE_URL"], api_key=os.environ["AZURE_OPENAI_API_KEY"])
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
PowerShell invocation
./scripts/verify-environment.ps1 # Windows (pwsh)
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
./scripts/resolve-project-id.ps1 -Endpoint "<foundry-project-endpoint>" # Windows (pwsh)
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
Hidden file in home directory
> 4. **Global config (last resort, mutates `~/.azure/config.json` for every azd project on the machi
The workflow references mutating a hidden Azure config file in the home directory. This can affect other projects on the machine.
High
Hidden file in home directory
- **Reaching for `azd config set defaults.subscription` / `defaults.location` as the *first* fix for
The workflow references mutating a hidden Azure config file in the home directory. This can affect other projects on the machine.
High
PowerShell invocation
./scripts/verify-environment.ps1 # Windows (pwsh)
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
./scripts/resolve-project-id.ps1 -Endpoint "<foundry-project-endpoint>" # Windows (pwsh)
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
.\.venv\Scripts\Activate.ps1 # Windows pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
Azure credential environment variables
| `azd deploy` postdeploy hook fails with missing `AZURE_TENANT_ID` | Run `az account show --query t
The workflow references Azure credential environment variables. These values can grant access and must be protected from logs and prompts.
High
Generic API/secret keys
If explicitly asked to use API key instead of managed identity, then use AzureOpenAIResponsesClient
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
PowerShell invocation
```pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
Generic API/secret keys
API_KEY="<your-api-key>"
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
Generic API/secret keys
--header "api-key: ${API_KEY}" \
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
PowerShell invocation
Do **not** start `azd ai agent run` as a detached process that you cannot monitor or stop (for examp
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
Generic API/secret keys
For authenticated MCP servers, create an `api_key` project connection to store credentials. Unauthen
The snippet accepts, reads, or forwards API keys through arguments, environment variables, clients, or headers. This is legitimate but sensitive secret handling.
High
PowerShell invocation
> ```pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```pwsh
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
Azure credential environment variables
After provision completes for a new project, run `azd env get-values` and set missing required azd e
The workflow references Azure credential environment variables. These values can grant access and must be protected from logs and prompts.
High
Python os.popen
token = os.popen("az account get-access-token --resource https://ai.azure.com --query accessToken -o
This runs an external process to obtain Azure context or tokens. Command execution can expose local state or act on Azure resources.
High
PHP/Python popen
token = os.popen("az account get-access-token --resource https://ai.azure.com --query accessToken -o
This runs an external process to obtain Azure context or tokens. Command execution can expose local state or act on Azure resources.
High
PowerShell invocation
4. Use `curl.exe` (not PowerShell `Invoke-RestMethod` / `Invoke-WebRequest`) on Windows — PowerShell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
../create/scripts/verify-environment.ps1 # Windows (pwsh)
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
*PowerShell version:*
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
*PowerShell version:*
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
This file contains the full step-by-step bash/PowerShell scripts for preset (optimal region) model d
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
*PowerShell version:*
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
*PowerShell version:*
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
*PowerShell version:*
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
*PowerShell version:*
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
# PowerShell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
| **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
3. **Azure PowerShell** — `Connect-AzAccount`
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
// Local development only — uses CLI/PowerShell/VS Code credentials
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
Azure credential environment variables
return process.env.AZURE_CLIENT_ID
The workflow references Azure credential environment variables. These values can grant access and must be protected from logs and prompts.
High
Azure credential environment variables
? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID) // user-assigned
The workflow references Azure credential environment variables. These values can grant access and must be protected from logs and prompts.
High
PowerShell invocation
- powershell: ">=7.0"
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
- **PowerShell**: `Register-AzResourceProvider -ProviderNamespace Microsoft.CognitiveServices`
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
PowerShell:
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
High
PowerShell invocation
```powershell
The workflow directs use of PowerShell scripts or commands. Those commands can execute local code and change Azure resources.
Medium
Python file write/append
with open(download_csv, "wb") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Hidden file access
_AZURE_COGSERVICES_SCOPE = "https://cognitiveservices.azure.com/.default"
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as out:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python shutil operations
shutil.copy2(args.input, args.output)
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(args.output, "w", encoding="utf-8") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(path, "w", encoding="utf-8") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python os file operations
os.makedirs(args.output_dir, exist_ok=True)
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(args.output, "w", encoding="utf-8") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(outfile, "w", encoding="utf-8") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Python file write/append
with open(name, "w") as f:
The script writes, creates, or copies local files for datasets, results, or outputs. User-controlled paths can overwrite important files if misused.
Medium
Hidden file access
> 4. **Global config (last resort, mutates `~/.azure/config.json` for every azd project on the machi
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
Capture `FOUNDRY_PROJECT_ENDPOINT` and `AZURE_AI_MODEL_DEPLOYMENT_NAME`. Write `src/<project>/.env`:
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
| `.azure/<env>/.env` (`azd env set`) | Secrets and `PARAM_<CONN>_<KEY>` credential values reference
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Shell command substitution
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Hardcoded IP address
startupCommand: "uvicorn app:app --host 0.0.0.0 --port 4001"
The service binds to 0.0.0.0, which can expose the local or container service on all interfaces.
Medium
Hidden file access
| MCP timeout (Toolbox) | Auth token expired or wrong scope | Use `https://ai.azure.com/.default`; r
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Shell command substitution
name=$(basename "$dir")
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ENDPOINT=$(azd ai toolbox show agent-tools -o json | jq -r .endpoint)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
TOK=$(az account get-access-token --resource "https://ai.azure.com" --query accessToken -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
TOKEN=$(az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Hidden file access
- **Agent → Toolbox:** Azure AD bearer token with scope `https://ai.azure.com/.default`, refreshed o
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
> ⚠️ Do **not** use scope `https://cognitiveservices.azure.com/.default`. The toolbox MCP endpoint r
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
| 401 on MCP calls | Expired token or wrong scope | Use scope `https://ai.azure.com/.default` (not `
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Shell command substitution
ENDPOINT=$(azd ai toolbox show agent-tools --output json | jq -r .endpoint)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Hidden file access
For authenticated peers, use `--auth-type project-managed-identity --audience https://ai.azure.com/.
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
Token scope: `https://ai.azure.com/.default`. RBAC: the calling identity (developer + agent identity
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
token = _credential.get_token("https://ai.azure.com/.default").token
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
| `401` on MCP calls | Expired / wrong-scope token. Use `https://ai.azure.com/.default`; refresh per
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
- Auth: Inject a bearer token with scope `https://ai.azure.com/.default` on every request (Python: `
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Shell command substitution
throw "az $($CommandArgs -join ' ') failed: $($raw -join "`n")"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
$choices = ($matches | ForEach-Object { "$($_.resourceGroup)/$($_.name)" }) -join ", "
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PARSED_ENDPOINT="$(
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
NORMALIZED_ENDPOINT="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["endpoint"])'
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ACCOUNT_NAME="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["accountName"])' <<<
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_NAME="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["projectName"])' <<<
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
stderr_file="$(mktemp)"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
if output="$(az "$@" 2>"$stderr_file")"; then
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
error_text="$(cat "$stderr_file")"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ACCOUNTS_JSON="$(run_az_json "${AZ_ARGS[@]}")" || fatal "Failed to list Cognitive Services accounts.
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ACCOUNTS_FILE="$(mktemp)"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
MATCHED_ACCOUNT="$(
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
RESOURCE_GROUP="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["resourceGroup"])'
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ACCOUNT_NAME="$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["accountName"])' <<<
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
if ! PROJECT_JSON="$(run_az_json "${AZ_SHOW_ARGS[@]}")"; then
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECTS_JSON="$(run_az_json "${AZ_LIST_ARGS[@]}")" || fatal "Failed to list Foundry projects."
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECTS_FILE="$(mktemp)"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_JSON="$(
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
Note-Warn "azd found at '$($azdCommand.AddedPath)' but was not on PATH. Added automatically for this
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
Note-Warn "az found at '$($azCommand.AddedPath)' but was not on PATH. Added automatically for this s
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Template literal with command substitution
$raw = (& azd auth login --check-status 2>&1) -join "`n"
This PowerShell script invokes azd and captures command output. It is expected preflight behavior, but it still executes a local command.
Medium
Shell command substitution
AZD_VERSION="$(azd version --output json 2>/dev/null | python3 -c 'import json,sys; print(json.load(
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
AZ_VERSION="$(az version --query '"azure-cli"' -o tsv 2>/dev/null || echo unknown)"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
EXT_JSON="$(azd extension list --installed --output json 2>/dev/null || echo '[]')"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
AZD_AUTH_OUTPUT="$(azd auth login --check-status 2>&1)"; AZD_AUTH_EXIT=$?
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
AZ_ACCOUNT_JSON="$(az account show --output json 2>/dev/null || true)"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
AZ_ACCOUNT_PARSED="$(printf '%s' "$AZ_ACCOUNT_JSON" | python3 -c 'import json,sys
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_JSON="$(azd ai project show --output json 2>/dev/null || echo '')"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ENDPOINT="$(printf '%s' "$PROJECT_JSON" | python3 -c 'import json,sys
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
AGENT_JSON="$(azd ai agent show --output json 2>/dev/null || echo '')"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
STATUS="$(printf '%s' "$AGENT_JSON" | python3 -c 'import json,sys
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Temp directory access
jq -r '.query' .foundry/datasets/support-bot-prod-traces-v2.jsonl | sort > /tmp/v2-queries.txt
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Medium
Temp directory access
jq -r '.query' .foundry/datasets/support-bot-prod-traces-v3.jsonl | sort > /tmp/v3-queries.txt
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Medium
Temp directory access
diff /tmp/v2-queries.txt /tmp/v3-queries.txt
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Medium
Hidden file access
| Auth | `Authorization: Bearer <Entra token>` for scope `https://ai.azure.com/.default` |
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Hidden file access
| `Authorization: Bearer <token>` | ✅ | Entra token for audience `https://ai.azure.com` (scope `http
The snippet accesses hidden local configuration or cache paths such as .env, .azure, or .foundry. These locations can hold sensitive workflow state.
Medium
Shell command substitution
TOKEN=$(az account get-access-token --resource "https://ai.azure.com" --query accessToken -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
SUB_ID=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
CAPACITY_JSON=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECTS_JSON=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
REGIONS=$(echo "$CAPACITY_JSON" | jq -r '.value[] | select(.properties.skuName=="GlobalStandard" and
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
usage_json=$(az cognitiveservices usage list --location "$region" --subscription "$SUB_ID" -o json 2
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
quota_avail=$(echo "$usage_json" | jq -r --arg name "OpenAI.GlobalStandard.$MODEL_NAME" \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Unix shell invocation
#!/bin/bash
The file is an executable shell script. Running it can inspect the host environment and call Azure tooling.
Medium
Shell command substitution
Available = "$($_.properties.availableCapacity)K TPM"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
SUB_ID=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
CAPACITY_RESULT=$(az rest --method GET --url "$URL" \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
REGIONS_WITH_CAP=$(echo "$CAPACITY_RESULT" | jq -r ".value[] | select(.properties.skuName==\"$SKU\"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
avail=$(echo "$CAPACITY_RESULT" | jq -r ".value[] | select(.location==\"$region\" and .properties.sk
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
usage_json=$(az cognitiveservices usage list --location "$region" --subscription "$SUB_ID" -o json 2
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
quota_avail=$(echo "$usage_json" | jq -r --arg name "OpenAI.$SKU.$MODEL_NAME" \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Unix shell invocation
#!/bin/bash
The file is an executable shell script. Running it can inspect the host environment and call Azure tooling.
Medium
Shell command substitution
usage_json=$(az cognitiveservices usage list --location <region> --subscription "$SUBSCRIPTION_ID" -
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
quota_available=$(echo "$usage_json" | jq -r --arg name "OpenAI.<SKU>.<model-name>" \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
MODEL_FORMAT=$(az cognitiveservices account list-models \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
TENANT_INFO=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
COUNTRY_CODE=$(echo "$TENANT_INFO" | jq -r '.countryCode')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ORG_NAME=$(echo "$TENANT_INFO" | jq -r '.displayName')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
SUBSCRIPTION_ID=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/subscriptions/\([^/]*\).*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
RESOURCE_GROUP=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/resourceGroups/\([^/]*\).*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ACCOUNT_NAME=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/accounts/\([^/]*\)/projects.*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_NAME=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/projects/\([^/?]*\).*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_REGION=$(az cognitiveservices account show \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
MODEL_FORMAT=$(az cognitiveservices account list-models \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
CAPACITY_JSON=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
CURRENT_CAPACITY=$(echo "$CAPACITY_JSON" | jq -r '.value[] | select(.properties.skuName=="GlobalStan
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ALL_REGIONS_JSON=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
AVAILABLE_REGIONS=$(jq -r '.value[] | select(.properties.skuName=="GlobalStandard" and .properties.a
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
UNAVAILABLE_REGIONS=$(jq -r '.value[] | select(.properties.skuName=="GlobalStandard" and (.propertie
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
echo "$(awk "BEGIN {printf \"%.1f\", $capacity/1000000}")M TPM"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
echo "$(awk "BEGIN {printf \"%.0f\", $capacity/1000}")K TPM"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
formatted_capacity=$(format_capacity "$capacity")
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
region_display=$(echo "$region" | sed 's/\([a-z]\)\([a-z]*\)/\U\1\L\2/g; s/\([a-z]\)\([0-9]\)/\1 \2/
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
region_display=$(echo "$region" | sed 's/\([a-z]\)\([a-z]*\)/\U\1\L\2/g; s/\([a-z]\)\([0-9]\)/\1 \2/
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECTS_IN_REGION=$(az cognitiveservices account list \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_COUNT=$(echo "$PROJECTS_IN_REGION" | jq '. | length')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
USER_ALIAS=$(az account show --query user.name -o tsv | cut -d'@' -f1 | tr '.' '-')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
RANDOM_SUFFIX=$(openssl rand -hex 2)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
DEPLOYMENT_NAME=$(bash scripts/generate_deployment_name.sh \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
SELECTED_CAPACITY=$(echo "$ALL_REGIONS_JSON" | jq -r ".value[] | select(.location==\"$SELECTED_REGIO
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
DEPLOY_CAPACITY=$((SELECTED_CAPACITY / 2))
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
TENANT_INFO=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
COUNTRY_CODE=$(echo "$TENANT_INFO" | jq -r '.countryCode')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ORG_NAME=$(echo "$TENANT_INFO" | jq -r '.displayName')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
STATUS=$(az cognitiveservices account deployment show \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ELAPSED=$((ELAPSED + INTERVAL))
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ELAPSED=$((ELAPSED + INTERVAL))
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ENDPOINT=$(az cognitiveservices account show \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
DEPLOYMENT_INFO=$(az cognitiveservices account deployment show \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
echo "Capacity: $(format_capacity $DEPLOY_CAPACITY)"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
DEPLOYMENT_URL=$(bash "$(dirname "$0")/scripts/generate_deployment_url.sh" \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Temp directory access
echo "$ALL_REGIONS_JSON" > /tmp/capacity_check.json
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Medium
Temp directory access
AVAILABLE_REGIONS=$(jq -r '.value[] | select(.properties.skuName=="GlobalStandard" and .properties.a
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Medium
Temp directory access
UNAVAILABLE_REGIONS=$(jq -r '.value[] | select(.properties.skuName=="GlobalStandard" and (.propertie
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Medium
Shell command substitution
SUBSCRIPTION_ID=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/subscriptions/\([^/]*\).*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
RESOURCE_GROUP=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/resourceGroups/\([^/]*\).*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ACCOUNT_NAME=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/accounts/\([^/]*\)/projects.*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_NAME=$(echo "$PROJECT_RESOURCE_ID" | sed -n 's|.*/projects/\([^/?]*\).*|\1|p')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECT_REGION=$(az cognitiveservices account show \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
CAPACITY_JSON=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
CURRENT_CAPACITY=$(echo "$CAPACITY_JSON" | jq -r '.value[] | select(.properties.skuName=="GlobalStan
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ALL_REGIONS_JSON=$(az rest --method GET \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
AVAILABLE_REGIONS=$(echo "$ALL_REGIONS_JSON" | jq -r '.value[] | select(.properties.skuName=="Global
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
UNAVAILABLE_REGIONS=$(echo "$ALL_REGIONS_JSON" | jq -r '.value[] | select(.properties.skuName=="Glob
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PROJECTS_IN_REGION=$(az cognitiveservices account list \
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
DEPLOYMENT_NAME=$(bash scripts/generate_deployment_name.sh "$ACCOUNT_NAME" "$RESOURCE_GROUP" "$MODEL
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
SELECTED_CAPACITY=$(echo "$ALL_REGIONS_JSON" | jq -r ".value[] | select(.location==\"$SELECTED_REGIO
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
DEPLOY_CAPACITY=$(( SELECTED_CAPACITY / 2 ))
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
GUID_HEX=$(echo "$SUBSCRIPTION_ID" | tr -d '-')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ENCODED_SUB=$(echo "$GUID_HEX" | xxd -r -p | base64 | tr '+' '-' | tr '/' '_' | tr -d '=')
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Unix shell invocation
#!/bin/bash
The file is an executable shell script. Running it can inspect the host environment and call Azure tooling.
Medium
Shell command substitution
az role assignment list --assignee "$(az ad signed-in-user show --query id -o tsv)" --query "[?conta
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
echo "ai-project-$(openssl rand -hex 4)"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
"ai-project-$(-join ((48..57)+(97..122) | Get-Random -Count 8 | ForEach-Object {[char]$_}))"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
deployment_count=$(az cognitiveservices account deployment list --name <resource> --resource-group <
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
resources=$(az cognitiveservices account list --query "[?kind=='AIServices'].{name:name,rg:resourceG
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
subId=$(az account show --query id -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
az role assignment list --assignee "$(az ad signed-in-user show --query id -o tsv)" --scope "<foundr
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
PRINCIPAL_ID=$(az cognitiveservices account show --name <foundry-resource-name> --resource-group <re
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
SP_APP_ID=$(az ad sp list --display-name "foundry-cicd-sp" --query "[0].appId" -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
TOTAL_RG_COUNT=$(az group list --query "length([])" -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
UNIQUE_SUFFIX=$(date +%s)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
TOTAL_RG_COUNT=$(az group list --query "length([])" -o tsv)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
Write-Host "$h -> $ip (reachable: $($reach.TcpTestSucceeded))"
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Medium
Shell command substitution
ip=$(dig +short "$h" | tail -n1)
This uses shell command substitution in a script or workflow command. Executing it runs local commands and depends on the caller environment.
Low
Hardcoded URL
--grader grader.py --n 20 --tools '[{"name": "search", "server_url": "https://..."}]'
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"), help="Project /v1/ endp
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"), help="API key")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Hardcoded URL
python check_training.py --base-url https://<resource>.services.ai.azure.com/api/projects/<project>/
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"), help="Project /v1/ endp
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"), help="API key")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Hardcoded URL
clients = get_clients(base_url="https://<resource>.services.ai.azure.com/api/projects/<project>/open
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
clients = get_clients(project_endpoint="https://<resource>.services.ai.azure.com/api/projects/<proje
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
clients = get_clients(azure_endpoint="https://<resource>.openai.azure.com",
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
_AZURE_COGSERVICES_SCOPE = "https://cognitiveservices.azure.com/.default"
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Python environment access
base_url = base_url or os.environ.get("OPENAI_BASE_URL")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
api_key = api_key or os.environ.get("AZURE_OPENAI_API_KEY")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
project_endpoint = project_endpoint or os.environ.get("AZURE_AI_PROJECT_ENDPOINT")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
azure_endpoint = azure_endpoint or os.environ.get("AZURE_OPENAI_ENDPOINT")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python HTTP libraries
resp = requests.put(url, headers={
The Python script sends Azure API requests with requests. Network calls can transmit tokens, job data, or deployment configuration.
Low
Python HTTP libraries
resp = requests.get(url, headers={"Authorization": f"Bearer {token}"}, timeout=(10, 60))
The Python script sends Azure API requests with requests. Network calls can transmit tokens, job data, or deployment configuration.
Low
Python HTTP libraries
except requests.exceptions.RequestException as e:
The Python script sends Azure API requests with requests. Network calls can transmit tokens, job data, or deployment configuration.
Low
Python HTTP libraries
resp = requests.delete(url, headers={"Authorization": f"Bearer {token}"}, timeout=(10, 60))
The Python script sends Azure API requests with requests. Network calls can transmit tokens, job data, or deployment configuration.
Low
Python HTTP libraries
resp = requests.get(url, headers={"Authorization": f"Bearer {token}"}, timeout=(10, 60))
The Python script sends Azure API requests with requests. Network calls can transmit tokens, job data, or deployment configuration.
Low
Hardcoded URL
base = (f"https://management.azure.com/subscriptions/{sub}"
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Python environment access
DEFAULT_SUB = os.environ.get("AZURE_SUBSCRIPTION_ID", "")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
DEFAULT_RG = os.environ.get("AZURE_RESOURCE_GROUP", "")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
DEFAULT_ACCOUNT = os.environ.get("AZURE_COGSERVICES_ACCOUNT", "")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
AZ_CLI = os.environ.get("AZ_CLI_PATH")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Hardcoded URL
python monitor_training.py --base-url https://<resource>.services.ai.azure.com/api/projects/<project
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
" python monitor_training.py --base-url https://<resource>.services.ai.azure.com/api/projects/<proj
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"), help="Project /v1/ endp
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"), help="API key")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"))
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python HTTP libraries
resp = requests.post(url, headers={
The Python script sends Azure API requests with requests. Network calls can transmit tokens, job data, or deployment configuration.
Low
Hardcoded URL
python submit_training.py --base-url https://<resource>.services.ai.azure.com/api/projects/<project>
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
python submit_training.py --endpoint https://<resource>.openai.azure.com --api-key KEY \
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Python environment access
parser.add_argument("--base-url", default=os.environ.get("OPENAI_BASE_URL"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--endpoint", default=os.environ.get("AZURE_OPENAI_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--project-endpoint", default=os.environ.get("AZURE_AI_PROJECT_ENDPOINT"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
parser.add_argument("--api-key", default=os.environ.get("AZURE_OPENAI_API_KEY"),
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
client = OpenAI(base_url=os.environ["OPENAI_BASE_URL"], api_key=os.environ["AZURE_OPENAI_API_KEY"])
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
dotenv library
Always use `load_dotenv(override=False)` so environment variables set by Foundry at runtime take pre
The workflow loads values from a .env file. Local environment files often contain sensitive project configuration.
Low
Python dotenv loader
Always use `load_dotenv(override=False)` so environment variables set by Foundry at runtime take pre
The workflow loads values from a .env file. Local environment files often contain sensitive project configuration.
Low
dotenv library
> **Critical: keep `.env` and `azd env` in sync.** `azd ai agent run` injects the active `azd env` v
The workflow loads values from a .env file. Local environment files often contain sensitive project configuration.
Low
Python dotenv loader
> **Critical: keep `.env` and `azd env` in sync.** `azd ai agent run` injects the active `azd env` v
The workflow loads values from a .env file. Local environment files often contain sensitive project configuration.
Low
Python environment access
url=os.environ["TOOLBOX_AGENT_TOOLS_MCP_ENDPOINT"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Hardcoded URL
./resolve-project-id.ps1 -Endpoint "https://my-account.services.ai.azure.com/api/projects/my-project
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
./resolve-project-id.ps1 -Endpoint "https://my-account.services.ai.azure.com/api/projects/my-project
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
# ./resolve-project-id.sh --endpoint "https://my-account.services.ai.azure.com/api/projects/my-pro
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
# ./resolve-project-id.sh --endpoint "https://my-account.services.ai.azure.com/api/projects/my-pro
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Temp file creation
stderr_file="$(mktemp)"
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Low
Temp file creation
ACCOUNTS_FILE="$(mktemp)"
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Low
Temp file creation
PROJECTS_FILE="$(mktemp)"
The workflow creates or uses temporary files. Temporary artifacts can leak sensitive data if names, permissions, or cleanup are weak.
Low
Python environment access
target = os.environ["ACCOUNT_NAME"].lower()
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
print(f"Could not find a Cognitive Services account matching '{os.environ['ACCOUNT_NAME']}'.", file=
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
print(f"Multiple accounts matched '{os.environ['ACCOUNT_NAME']}': {choices}. Re-run with --resource-
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
expected = os.environ["NORMALIZED_ENDPOINT"].rstrip("/")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
project = json.loads(os.environ["PROJECT_JSON"])
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
expected = os.environ["NORMALIZED_ENDPOINT"].rstrip("/")
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
if os.environ["OUTPUT"] == "json":
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
"resourceGroup": os.environ["RESOURCE_GROUP"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
"accountName": os.environ["ACCOUNT_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
"projectName": os.environ["PROJECT_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Hardcoded URL
Note-Action "Azure Developer CLI (azd) is not installed. Install it from https://aka.ms/azd-install,
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
Note-Action "Azure CLI (az) is not installed. Install it from https://aka.ms/installazurecli, then r
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
note_action "Azure Developer CLI (azd) is not installed. Install it from https://aka.ms/azd-install,
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
note_action "Azure CLI (az) is not installed. Install it from https://aka.ms/installazurecli, then r
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Standard device file access
. /etc/environment 2>/dev/null || true
The script reads a host environment file during preflight. This is low-risk context discovery, but it still inspects local system configuration.
Low
Hardcoded URL
--url "https://management.azure.com/subscriptions/$subId/providers/Microsoft.CognitiveServices/model
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
--url "https://management.azure.com/subscriptions/$subId/providers/Microsoft.CognitiveServices/accou
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
--url "https://management.azure.com/subscriptions/${SUB_ID}/providers/Microsoft.CognitiveServices/mo
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
--url "https://management.azure.com/subscriptions/${SUB_ID}/providers/Microsoft.CognitiveServices/ac
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
$url = "https://management.azure.com/subscriptions/$subId/providers/Microsoft.CognitiveServices/loca
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
$url = "https://management.azure.com/subscriptions/$subId/providers/Microsoft.CognitiveServices/mode
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
URL="https://management.azure.com/subscriptions/${SUB_ID}/providers/Microsoft.CognitiveServices/loca
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
URL="https://management.azure.com/subscriptions/${SUB_ID}/providers/Microsoft.CognitiveServices/mode
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
$baseUrl = "https://ai.azure.com/nextgen/r/"
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Hardcoded URL
BASE_URL="https://ai.azure.com/nextgen/r/"
The script contains hardcoded Azure service URLs used for API calls. Network access is expected, but targets should remain scoped and visible.
Low
Environment variable access (dot notation)
const credential = process.env.NODE_ENV === "development"
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Environment variable access (dot notation)
if (process.env.NODE_ENV === "development") {
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Environment variable access (dot notation)
return process.env.AZURE_CLIENT_ID
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Environment variable access (dot notation)
? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID) // user-assigned
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Environment variable object
const credential = process.env.NODE_ENV === "development"
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Environment variable object
if (process.env.NODE_ENV === "development") {
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Environment variable object
return process.env.AZURE_CLIENT_ID
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Environment variable object
? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID) // user-assigned
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python getenv function
if os.getenv("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
getenv function call
if os.getenv("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
getenv function call
var credential = "Development".equals(System.getenv("AZURE_FUNCTIONS_ENVIRONMENT"))
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
endpoint=os.environ["FOUNDRY_PROJECT_ENDPOINT"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
os.environ["AZURE_AI_SEARCH_CONNECTION_NAME"]
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
model=os.environ["FOUNDRY_MODEL_DEPLOYMENT_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
index_name=os.environ["AI_SEARCH_INDEX_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
model=os.environ["MODEL_DEPLOYMENT_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
model=os.environ["MODEL_DEPLOYMENT_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
model=os.environ["MODEL_DEPLOYMENT_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
azure_openai_endpoint=os.environ["AZURE_OPENAI_ENDPOINT"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
azure_openai_deployment=os.environ["AZURE_OPENAI_DEPLOYMENT"]
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
Python environment access
model=os.environ["MODEL_DEPLOYMENT_NAME"],
The code or example reads environment variables for configuration or credentials. This is expected, but secret values require redaction.
Low
dotenv library
pip install azure-ai-projects azure-identity azure-ai-inference openai azure-ai-evaluation python-do
The workflow loads values from a .env file. Local environment files often contain sensitive project configuration.
Low
dotenv library
1. **Never hardcode credentials** — use environment variables and `python-dotenv`
The workflow loads values from a .env file. Local environment files often contain sensitive project configuration.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (24)
RISK-001 High
Environment file access
2. If the user supplied an existing project endpoint, project ARM ID, or model deployment name, set
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-002 High
Environment file access
3. Create the agent source `.env` with the same endpoint and model deployment values:
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-003 High
Environment file access
Capture `FOUNDRY_PROJECT_ENDPOINT` and `AZURE_AI_MODEL_DEPLOYMENT_NAME`. Write `src/<project>/.env`:
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-004 High
Environment file access
Also mirror them into the azd env (so `azd ai agent run` injects the right values — it reads azd env
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-005 High
Environment file access
| Local invoke returns model `404` / wrong deployment | Stale `AZURE_AI_MODEL_DEPLOYMENT_NAME` in az
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-006 High
Environment file access
Always use `load_dotenv(override=False)` so environment variables set by Foundry at runtime take pre
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-007 High
Environment file access
Required `.env` variables:
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-008 High
Environment file access
| `.azure/<env>/.env` (`azd env set`) | Secrets and `PARAM_<CONN>_<KEY>` credential values reference
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-009 High
Environment file access
> **Prerequisite:** Local run does NOT require `azd provision` or any deployed Azure infrastructure.
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-010 High
Environment file access
> 🚦 **If no project endpoint is configured (not in the message, `azd env`, or `.env`) and the user
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-011 High
Environment file access
> **Critical: keep `.env` and `azd env` in sync.** `azd ai agent run` injects the active `azd env` v
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-012 High
Environment file access
> A stale `AZURE_AI_MODEL_DEPLOYMENT_NAME` in `azd env` can make local run call the wrong deployment
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-013 High
Environment file access
**Env vars** — set in `.env` for local run, and in the agent service's `environmentVariables` in `az
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-014 High
Environment file access
**Env vars** — set in `.env` for local run, and in the agent service's `environmentVariables` in `az
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-015 High
Environment file access
Hosted agents read the MCP endpoint from a single environment variable. The **canonical** name is **
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-016 High
Environment file access
If the user provides a toolbox name or endpoint URL, or the project already references a toolbox (e.
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-017 High
Environment file access
Once the user supplies the toolbox name/endpoint — either an existing one or a new one they create v
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-018 High
Environment file access
- **Local development:** set `APPLICATIONINSIGHTS_CONNECTION_STRING` in the agent's `.env`.
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-019 High
Environment file access
> 🚦 **Project-selection gate.** If no foundry project endpoint is configured (not in the message, `
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-020 High
Environment file access
> 💡 **Mirror IDs to metadata immediately.** Right after `evaluation_agent_batch_eval_create` return
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-021 High
Environment file access
const credential = process.env.NODE_ENV === "development"
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-022 High
Environment file access
if (process.env.NODE_ENV === "development") {
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-023 High
Environment file access
return process.env.AZURE_CLIENT_ID
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
RISK-024 High
Environment file access
? new ManagedIdentityCredential(process.env.AZURE_CLIENT_ID) // user-assigned
The workflow reads or writes .env or azd environment values. These files can contain endpoints, deployment names, and credentials.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighCommand execution can affect local machines and Azure subscriptions.Require explicit user confirmation before az, azd, shell, or PowerShell commands, and show the target subscription, resource group, and environment.
- FIX-002HighSeveral workflows handle API keys, Azure credential environment variables, .env files, and azd environment values.Prefer managed identity and project connections, redact secrets from logs, and avoid copying secret values into metadata or prompts.
- FIX-003HighThe grader calibration script executes local grader source with exec and compile.Replace dynamic execution with a constrained grader interface, or require a trusted local path and a clear warning before execution.
- FIX-004MediumDataset, evaluation, and training scripts write local files and temporary artifacts.Constrain writes to the selected project or .foundry output folders, and ask before overwriting existing files.
- FIX-005MediumNetwork requests target Azure APIs and Foundry endpoints.Keep endpoints scoped to expected Microsoft Azure domains, use timeouts, and present the target resource before mutating requests.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable