Skills azure-keyvault-py
📦
azure-keyvault-py
Content revision r2 High Risk ⚙️ External commands🌐 Network access
Manage Azure Key Vault with Python
Python teams need reliable patterns for using Azure Key Vault without custom integration code. This skill provides focused examples for secrets, keys, certificates, cryptography, asynchronous access, and error handling.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "azure-keyvault-py" from https://skillstore.io/skills/sickn33-azure-keyvault-py.md and its manifest at https://skillstore.io/api/skills/sickn33-azure-keyvault-py/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "azure-keyvault-py". Plan a secure secret retrieval flow for an Azure-hosted Python service.
Expected outcome:
- Authentication: use the workload managed identity through DefaultAzureCredential.
- Authorization: grant only secret read permissions through Azure RBAC.
- Handling: keep the value in memory, never log it, and cache it only for the required duration.
Using "azure-keyvault-py". Compare the main Azure Key Vault client types.
Expected outcome:
- SecretClient manages secret values and versions.
- KeyClient manages cryptographic key resources.
- CryptographyClient performs operations with a selected key.
- CertificateClient manages certificate resources and policies.
Security Audit
High Riskv5 • 7/23/2026 Open versioned report
All 40 static findings are false positives caused by Markdown syntax, Azure endpoint placeholders, or SDK references. However, two examples print retrieved secret values and could expose credentials through logs.
1
Files scanned
256
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Secret Values Printed to Standard Output
The synchronous and asynchronous examples print retrieved secret values, which can expose credentials through terminal history, logs, or monitoring systems.
Both examples directly pass the SDK secret value to print, creating a clear disclosure path when copied or executed.
Risk Factors
⚙️ External commands (25)
SKILL.md:15-27 SKILL.md:27-31 SKILL.md:31-33 SKILL.md:33-39 SKILL.md:39-47 SKILL.md:47-51 SKILL.md:51-80 SKILL.md:80-86 SKILL.md:86-94 SKILL.md:94-98 SKILL.md:98-118 SKILL.md:118-122 SKILL.md:122-153 SKILL.md:153-159 SKILL.md:159-167 SKILL.md:167-171 SKILL.md:171-194 SKILL.md:194-200 SKILL.md:200 SKILL.md:201 SKILL.md:202 SKILL.md:203 SKILL.md:207-221 SKILL.md:221-225 SKILL.md:225-236
🌐 Network access (5)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-azure-keyvault-py/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-azure-keyvault-py?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-azure-keyvault-py?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-azure-keyvault-py/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-azure-keyvault-py.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). azure-keyvault-py security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-azure-keyvault-py/audits/5BibTeX citation
@techreport{sickn33-sickn33-azure-keyvault-py-2026,
author = {sickn33},
title = {azure-keyvault-py security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-azure-keyvault-py/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-keyvault-py security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-azure-keyvault-py/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-azure-keyvault-py:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Integrate Application Secrets
Add identity-based secret retrieval to a Python service without storing Azure credentials in application code.
Standardize Vault Operations
Create consistent examples for secret, key, and certificate lifecycle tasks across Azure environments.
Review Cryptographic Workflows
Evaluate SDK patterns for remote encryption, signing, certificate retrieval, RBAC, and error handling.
Try These Prompts
Create a Basic Secret Client
Create a Python example that authenticates with DefaultAzureCredential and retrieves a named secret from my Azure Key Vault URL.
Plan a Secret Lifecycle
Design a Python workflow to create, list, version, delete, and recover a Key Vault secret with clear error handling.
Use Remote Cryptography
Build a Python example that uses a Key Vault RSA key to encrypt, decrypt, sign, and verify data.
Review an Async Integration
Review my asynchronous Key Vault integration for RBAC, client cleanup, secret caching, exception handling, and prevention of secret logging.
Best Practices
- Use managed identity with DefaultAzureCredential for applications hosted on Azure.
- Grant each workload only the required Azure RBAC permissions.
- Keep secret and private-key values out of logs, source control, and persistent caches.
Avoid
- Do not hardcode production secrets or service principal credentials in Python files.
- Do not purge deleted resources without an approved recovery and retention process.
- Do not cache retrieved secret values longer than the application requires.
Frequently Asked Questions
Which packages does this skill cover?
It covers Azure Identity plus the Key Vault secrets, keys, and certificates packages for Python.
How should applications authenticate?
Use DefaultAzureCredential and prefer managed identity for workloads hosted on Azure.
Does Key Vault return secret values when listing secrets?
No. Listing returns secret metadata, while get operations return a selected secret value.
Can I use asynchronous clients?
Yes. The skill includes an asynchronous SecretClient example for high-throughput applications.
How are certificate private keys retrieved?
An authorized SecretClient can retrieve the certificate secret. Protect the returned value as sensitive key material.
Are the examples ready for production?
No. Replace placeholders, remove secret-value printing, verify RBAC, close clients correctly, and test error handling in your environment.