技能 azure-compute

📦

azure-compute

Name: azure-compute
Author: microsoft

v0.0.0-placeholder 内容修订 r2 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "azure-compute" from https://skillstore.io/skills/microsoft-azure-compute.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-compute/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/microsoft-azure-compute.md 已签名 manifest GET /api/skills/microsoft-azure-compute/manifest 已签名 lockfile GET /api/skills/microsoft-azure-compute/lockfile

测试它

正在使用“azure-compute”。我需要一个用于 eastus 中开发 Web 服务器的低成本 VM。

预期结果:

主要建议：B-series，适用于可突发、低成本的开发工作负载。
替代方案：如果持续 CPU 性能比价格更重要，请选择 D-series。
下一步：购买前验证当前区域可用性和零售定价。

正在使用“azure-compute”。对于每天有流量高峰的公共 API，我应该使用 VMSS 吗？

预期结果:

建议：生产可用性至少使用两个实例的 VMSS Flexible。
自动缩放计划：在流量高峰前安排更高的基线，并添加基于 CPU 的横向扩展。
成本说明：估算最小和最大实例数量，因为 VMSS 按 VM 收费。

正在使用“azure-compute”。比较适合内存密集型数据库工作负载的选项。

预期结果:

主要系列：E-series，适用于每 vCPU 高内存和可预测的数据库性能。
大内存选项：当工作负载需要非常高的 RAM 容量时使用 M-series。
权衡：内存优化规格的成本高于均衡型 D-series 实例。

安全审计

高风险

v5 • 2026/7/23 打开版本化报告

Most static alerts are documentation syntax, official Microsoft endpoints, private or sample addresses, and SSH public-key references. Fourteen static findings remain confirmed because they contact a third party or change remote firewall, authentication, privilege, networking, or SELinux state. Semantic review also found shell injection exposure, fail-open ingress, unsafe host-key guidance, broad unconfirmed EMM changes, and plaintext password handling.

已扫描文件

3,381

分析行数

复核项

已忽略误报

已确认安全问题 (16)

高

workflows/vm-troubleshooter/references/firewall-blocking.md:33

System reconnaissance

--command-id RunPowerShellScript \

The paired remote command enables the Windows Remote Desktop firewall rule. This changes guest firewall policy and can increase administrative network exposure.

高

workflows/vm-troubleshooter/references/firewall-blocking.md:48

System reconnaissance

--command-id RunShellScript --scripts "iptables -I INPUT -p tcp --dport 22 -j ACCEPT"

The command inserts an iptables rule that permits inbound SSH. This changes guest firewall policy and may expose port 22 beyond the intended source network.

高

workflows/vm-troubleshooter/references/firewall-blocking.md:52

System reconnaissance

--command-id RunShellScript \

This Run Command begins a persistent firewalld change that opens the SSH service. The operation changes a VM security control and needs explicit approval.

高

workflows/vm-troubleshooter/references/firewall-blocking.md:57

System reconnaissance

--command-id RunShellScript --scripts "ufw status; ufw allow 22/tcp"

The command runs ufw allow for port 22 on the remote VM. It changes firewall policy and can broaden SSH exposure.

高

workflows/vm-troubleshooter/references/ssh-connectivity.md:47

System reconnaissance

--command-id RunShellScript --scripts "setenforce 0"

The command sets SELinux to permissive mode on the remote VM. This weakens mandatory access controls and should only run after explicit approval with a restoration plan.

高

workflows/vm-creator/references/delivery-options/github-pr.md:5-12 workflows/vm-creator/references/delivery-options/github-pr.md:25-51

Unvalidated shell placeholders in GitHub delivery

The workflow accepts user-supplied repository, branch, and target path values, then inserts them into shell commands without validation or consistent quoting. Crafted values could execute unintended commands.

The same file collects user-controlled branch and path values and later places those placeholders in shell command positions. No allowlist validation or complete shell quoting is specified.

高

workflows/vm-creator/references/depth-probe/beginner.md:16

Fail-open management port exposure

The beginner flow permits an unrestricted source when public IP detection fails. This can expose SSH or RDP management ports to the entire internet.

The guidance explicitly allows a wildcard source after detection failure. A warning in the Plan Card does not prevent generation of the exposed configuration.

高

workflows/vm-troubleshooter/references/ssh-connectivity.md:13

SSH host key removal lacks fingerprint verification

The SSH troubleshooting table recommends removing the old known_hosts entry after redeployment without first verifying the replacement host key. This can normalize a man-in-the-middle warning.

The line directly maps host-key verification failure to deleting the stored entry and provides no fingerprint validation step. The omission is security-relevant even in a legitimate redeployment.

显示全部 16 条已确认问题

高

workflows/essential-machine-management/references/emm-enable-flow.md:115-137 workflows/essential-machine-management/references/emm-enable-flow.md:162-185

Subscription-wide EMM changes lack a final confirmation gate

The EMM flow registers providers and submits a subscription-level deployment on the user behalf without an explicit final confirmation. Enrollment affects existing VMs and can enable paid services.

The workflow states that Copilot performs commands and API calls, then reaches provider registration and PUT or DELETE operations without a final approval instruction. The documented scope and pricing effects are subscription-wide.

高

workflows/vm-creator/references/output-adapters/az-cli.md:65 workflows/vm-troubleshooter/references/ssh-connectivity.md:33-35 workflows/vm-troubleshooter/references/rdp-connectivity.md:40-41 workflows/vm-troubleshooter/references/credential-auth-errors.md:32-33 workflows/vm-troubleshooter/references/credential-auth-errors.md:48-50

Plaintext passwords in command arguments

Creator and troubleshooting guidance place VM administrator passwords directly in command arguments. These secrets can remain in shell history, transcripts, or process listings.

Each cited command passes a password through an az CLI argument. Command-line secrets can be retained in shell history and exposed through process inspection.

中

workflows/vm-troubleshooter/references/credential-auth-errors.md:9

System reconnaissance

| "Your credentials did not work" | Reset password via Portal or CLI

The table recommends resetting a VM password through the portal or CLI. This changes credentials and can affect account access.

中

workflows/vm-troubleshooter/references/credential-auth-errors.md:54

System reconnaissance

--command-id RunShellScript --scripts "passwd -u <username>"

The command remotely unlocks a Linux account with passwd. This changes authentication state and should require explicit user confirmation and target verification.

中

workflows/vm-troubleshooter/references/network-connectivity.md:57

System reconnaissance

--command-id RunShellScript --scripts "ip link set eth0 up && dhclient eth0"

The remote command brings eth0 up and renews DHCP configuration. It mutates guest networking and could disrupt connectivity if the interface name or configuration is wrong.

低

workflows/vm-creator/examples/terraform/README.md:14

Network reconnaissance

MY_IP=$(curl -s ifconfig.me)/32 # your current public IP, locked to /32

The command discovers the caller public IP through ifconfig.me. The purpose is narrow NSG scoping, but the lookup still discloses client metadata to a third party.

低

workflows/vm-creator/references/depth-probe/beginner.md:16

Network reconnaissance

- **NSG:** create new, allow SSH 22 (Linux) or RDP 3389 (Windows) from **the user's current public I

The workflow explicitly instructs using ifconfig.me or an equivalent service to discover the user's public IP. This discloses client network metadata to a third party.

低

workflows/vm-creator/references/depth-probe/networking-deep.md:9

Network reconnaissance

| NSG | "Inbound rules: default (SSH/RDP from your IP) or paste a rule set?" | Restrict source to us

The workflow explicitly instructs curl to query ifconfig.me for the user's public IP. This sends client network metadata to a third-party service.

能力复核项 (3)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

workflows/vm-troubleshooter/references/credential-auth-errors.md:25

sudo privilege escalation

| sudo password prompt fails / user not in sudoers | Fix via Run Command or Serial Consol

The workflow recommends fixing sudo access through Run Command or Serial Console. This can grant administrative privileges and requires explicit authorization.

高

workflows/vm-troubleshooter/references/firewall-blocking.md:33

PowerShell invocation

--command-id RunPowerShellScript \

This Azure Run Command invokes PowerShell to enable the Remote Desktop firewall rule. It changes guest firewall policy and can increase network exposure if applied without explicit approval.

中

workflows/vm-creator/examples/terraform/README.md:14

Shell command substitution

MY_IP=$(curl -s ifconfig.me)/32 # your current public IP, locked to /32

This example contacts ifconfig.me to derive the caller public IP for an NSG source. It reveals client metadata to a third-party service and adds an external dependency.

风险因素

⚙️ 外部命令 (41)

🌐 网络访问 (33)

📁 文件系统访问 (50)

检测到的模式

Network reconnaissance×3System reconnaissance×8

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/microsoft-azure-compute/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-compute/security.svg)](https://skillstore.io/skills/microsoft-azure-compute?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/microsoft-azure-compute?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-compute/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-compute.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

microsoft. (2026). azure-compute security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-compute/audits/5

BibTeX 引用

@techreport{microsoft-microsoft-azure-compute-2026,
  author = {microsoft},
  title = {azure-compute security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/microsoft-azure-compute/audits/5},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-compute security audit report (audit version 5)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-azure-compute/audits/5"
identifiers:
  - type: other
    value: "skillstore:microsoft-azure-compute:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

规划可扩展的 Web 层

为需要自动缩放和负载均衡的无状态服务比较单个 VM 和 VMSS 选项。

选择数据库基础设施

为关系数据库、缓存和大型数据工作负载选择内存、存储和可用性选项。

估算计算预算范围

跨区域、定价类型和预期实例数量比较每小时和每月 VM 成本。

试试这些提示

推荐一个基础 VM

为 eastus 中的小型 Linux Web 应用推荐一个 Azure VM。平衡成本和性能，并解释主要权衡。

比较 VM 系列

为需要 8 vCPUs、高内存、premium SSD 和可预测性能的 PostgreSQL 工作负载比较 Azure VM 系列。

设计一个 VMSS 选项

为无状态 API 推荐一个 VMSS 设计，要求两个最小实例、CPU 自动缩放、区域复原能力和月度成本估算。

构建受约束的候选清单

为具有 GPU 需求、Spot 容忍度、Linux、westus3 定价和故障转移考虑因素的 ML 推理创建三个 Azure 计算选项。

最佳实践

提供工作负载类型、区域、操作系统、性能需求和预算优先级。
在根据建议采取行动之前，验证当前 Microsoft Learn 规格。
按最小、平均和最大实例数量估算 VMSS 成本。

避免

不要使用此技能部署或更改 Azure 资源。
不要依赖过时的参考数据做出最终生产决策。
不要在没有区域、操作系统和 SKU 假设的情况下请求价格估算。

常见问题

此技能是否需要 Azure 帐户？

不需要。它使用公开的 Microsoft 文档和无需身份验证的 Azure Retail Prices API。

它可以部署虚拟机或规模集吗？

不能。它只会为规划决策推荐选项并解释权衡。

它支持 VM Scale Sets 吗？

支持。它有助于判断何时适合使用 VMSS，并建议编排、自动缩放和负载均衡模式。

定价估算是最终报价吗？

不是。它们是零售估算，可能不包含折扣、许可、存储、网络和税费。

哪些 AI 工具可以使用此技能？

报告列出了对 Claude、Codex 和 Claude Code 的支持。

它可以比较 GPU、HPC 和机密计算规格吗？

可以。它包含系列指导，但应验证当前可用性和规格。

开发者详情

作者

microsoft

许可证

MIT

作者版本

v0.0.0-placeholder

Skillstore 修订

仓库

https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-compute/

引用

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

维护新鲜度

2026/7/26

使用量

6 次下载 · 257 次浏览

文件结构

📁 references/

📄 retail-prices-api.md

📄 vm-families.md

📄 vm-quotas.md

📄 vmss-guide.md

📄 SKILL.md

📄 version.json

📁 workflows/

📁 capacity-reservation/

📄 capacity-reservation.md

📁 references/

📄 association-disassociation.md

📄 capacity-reservation-overview.md

📁 essential-machine-management/

📄 essential-machine-management.md

📁 references/

📄 emm-enable-flow-portal-guidance.md

📄 emm-enable-flow.md

📄 emm-overview.md

📄 emm-prerequisites.md

📁 vm-creator/

📁 examples/

📁 bicep/

📄 main.bicep

📄 README.md

📁 terraform/

📄 main.tf

📄 outputs.tf

📄 README.md

📄 variables.tf

📁 references/

📁 delivery-options/

📄 github-pr.md

📄 index.md

📄 print.md

📄 save-local.md

📁 depth-probe/

📄 beginner.md

📄 cost-deep.md

📄 index.md

📄 networking-deep.md

📄 security-deep.md

📄 spec-deep.md

📄 mcp-tools.md

📁 output-adapters/

📄 az-cli.md

📄 bicep.md

📄 index.md

📄 mcp-apply.md

📄 terraform.md

📄 plan-card.md

📄 validation-gates.md

📄 vm-creator.md

📁 vm-recommender/

📁 references/

📄 handoff-to-creator.md

📄 web-fetch-policy.md

📄 vm-recommender.md

📁 vm-troubleshooter/

📁 references/

📄 cannot-connect-to-vm.md

📄 credential-auth-errors.md

📄 firewall-blocking.md

📄 network-connectivity.md

📄 rdp-connectivity.md

📄 rdp-service-config.md

📄 ssh-connectivity.md

📄 vm-agent-not-responding.md

📄 vm-troubleshooter.md