技能 azure-deploy
📦

azure-deploy

v0.0.0-placeholder 内容修订 r2 严重 ⚙️ 外部命令🔑 环境变量📁 文件系统访问🌐 网络访问

带防护机制部署 Azure 应用

如果未先验证环境、订阅和区域选择，Azure 部署就会失败。此技能通过 Azure 专属检查、配方和恢复步骤指导最终部署。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "azure-deploy" from https://skillstore.io/skills/microsoft-azure-deploy.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-deploy/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/microsoft-azure-deploy.md 已签名 manifest GET /api/skills/microsoft-azure-deploy/manifest 已签名 lockfile GET /api/skills/microsoft-azure-deploy/lockfile

测试它

正在使用“azure-deploy”。 部署我的已验证 Azure Functions 应用。

预期结果:

助手会确认已验证的计划，检查目标订阅和区域，选择 Azure Functions 配方，然后给出部署和验证步骤。

正在使用“azure-deploy”。 我的 Terraform Azure 部署在 apply 后失败。

预期结果:

助手会审查 Terraform 输出、资源组状态、端点健康状况和常见错误，然后建议受控的重试路径。

正在使用“azure-deploy”。 为 Azure 准备 GitHub Actions 部署。

预期结果:

助手会列出所需的 Azure 密钥、环境变量、受保护环境设置、登录步骤、部署操作和部署后检查。

安全审计

严重
v5 • 2026/7/23 打开版本化报告

Most findings are false positives from Markdown formatting, relative links, project .azure paths, read-only Azure queries, and documented environment identifiers. Confirmed risks include unsafe shell evaluation, command-line registry password exposure, and a remote installer piped to Bash. Additional concerns include mutable dependencies, broad SQL schema privileges, and unvalidated health-check targets.

42
已扫描文件
3,650
分析行数
6
复核项
0
已忽略误报

已确认安全问题 (5)

严重
references/sdk/azd-deployment.md:8
Pipe to shell pattern
curl -fsSL https://aka.ms/install-azd.sh | bash
The command downloads a remote script and pipes it directly to Bash without pinning or verification. A compromised response would execute arbitrary code.
高
references/recipes/azd/errors.md:152-164
Registry Password Exposed in Command Arguments
The fallback retrieves an ACR administrator password and passes it with docker login -p. Other local processes and logs can expose the credential.
The commands directly retrieve a live password and place it in a process argument in both shell variants.
高
references/recipes/azd/sql-managed-identity.md:24-29references/recipes/azd/scripts/grant-and-migrate.sh:67-94references/recipes/azd/scripts/grant-and-migrate.ps1:45-72
Application Identity Receives Schema Administration
Deployment guidance grants the runtime identity db_ddladmin with read and write roles. A compromised application could alter or drop database schema.
The SQL explicitly adds the application identity to db_ddladmin, db_datareader, and db_datawriter in every documented variant.
高
references/recipes/cicd/examples/github-azd.yml:8-24references/recipes/azd/scripts/apply-migrations.sh:43-46references/recipes/azd/scripts/grant-and-migrate.sh:53-56
Mutable Deployment Dependencies
CI workflows use mutable action tags with OIDC permission, and migration scripts install unpinned global tools. Upstream changes could execute during deployment.
The workflow uses version tags instead of commit SHAs, while scripts install current package versions without integrity or version constraints.
高
references/recipes/azd/post-deployment.md:74-82references/recipes/azd/verify.md:21-36
Project-Controlled Health Check Targets
Health checks request endpoints loaded from project-controlled AZD values without validating the host. A crafted project can direct the agent toward internal services.
The endpoint comes from local AZD environment state and is passed directly to curl or Invoke-WebRequest without a scheme or hostname allowlist.
能力复核项 (6)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
references/recipes/azd/errors.md:154
Shell command substitution
ACR_PASS=$(az acr credential show --name <acr-name> --query "passwords[0].value" -o tsv)
This captures a live registry password, and the next command passes it through docker login -p. Process inspection and logs can expose it.
高
references/recipes/azd/post-deployment.md:38
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
高
references/recipes/azd/sql-managed-identity.md:16
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
高
references/recipes/azd/sql-managed-identity.md:83
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
高
references/recipes/azd/sql-managed-identity.md:171
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.
高
references/recipes/azd/verify.md:85
Shell command substitution
eval $(azd env get-values)
eval executes AZD environment values as shell code. A crafted project environment value can run arbitrary commands with the agent privileges.

风险因素

⚙️ 外部命令 (50)
references/auth-best-practices.md:16 references/auth-best-practices.md:81 references/auth-best-practices.md:87 references/live-role-verification.md:97-102 references/pre-deploy-checklist.md:121-122 references/pre-deploy-checklist.md:181-182 references/pre-deploy-checklist.md:322-323 references/pre-deploy-checklist.md:324-326 references/pre-deploy-checklist.md:327-328 references/pre-deploy-checklist.md:348-349 references/pre-deploy-checklist.md:365-366 references/pre-deploy-checklist.md:399-400 references/pre-deploy-checklist.md:401-417 references/pre-deploy-checklist.md:339-342 references/pre-deploy-checklist.md:356-359 references/pre-deploy-checklist.md:374-378 references/pre-deploy-checklist.md:439 references/pre-deploy-checklist.md:118 references/pre-deploy-checklist.md:119 references/pre-deploy-checklist.md:178 references/pre-deploy-checklist.md:179 references/pre-deploy-checklist.md:318 references/pre-deploy-checklist.md:319 references/pre-deploy-checklist.md:345 references/pre-deploy-checklist.md:346 references/pre-deploy-checklist.md:362 references/pre-deploy-checklist.md:363 references/pre-deploy-checklist.md:395 references/pre-deploy-checklist.md:396 references/pre-deploy-checklist.md:443 references/pre-deploy-checklist.md:444 references/pre-deploy-checklist.md:457 references/pre-deploy-checklist.md:458 references/recipes/azcli/verify.md:40 references/recipes/azcli/verify.md:44 references/recipes/azcli/verify.md:48 references/recipes/azcli/verify.md:52 references/recipes/azcli/verify.md:53 references/recipes/azd/ef-migrations.md:56 references/recipes/azd/ef-migrations.md:14 references/recipes/azd/ef-migrations.md:15 references/recipes/azd/ef-migrations.md:33 references/recipes/azd/ef-migrations.md:59 references/recipes/azd/ef-migrations.md:60 references/recipes/azd/ef-migrations.md:90 references/recipes/azd/errors.md:72-73 references/recipes/azd/errors.md:74-76 references/recipes/azd/errors.md:47 references/recipes/azd/errors.md:48 references/recipes/azd/errors.md:65
🔑 环境变量 (19)
references/auth-best-practices.md:43 references/auth-best-practices.md:101 references/auth-best-practices.md:104 references/auth-best-practices.md:105 references/auth-best-practices.md:43 references/auth-best-practices.md:101 references/auth-best-practices.md:104 references/auth-best-practices.md:105 references/auth-best-practices.md:57 references/auth-best-practices.md:57 references/auth-best-practices.md:69 references/auth-best-practices.md:104 references/auth-best-practices.md:105 references/recipes/cicd/examples/github-azd.yml:26 references/recipes/cicd/examples/github-azd.yml:27 references/recipes/cicd/examples/github-bicep.yml:17 references/recipes/cicd/examples/github-bicep.yml:18 references/recipes/cicd/README.md:30 references/sdk/azure-identity-py.md:27
📁 文件系统访问 (34)
references/pre-deploy-checklist.md:378 references/recipes/azcli/README.md:10 references/recipes/azcli/README.md:16 references/recipes/azd/ef-migrations.md:43 references/recipes/azd/ef-migrations.md:43 references/recipes/azd/ef-migrations.md:10 references/recipes/azd/errors.md:24 references/recipes/azd/functions-deploy.md:103 references/recipes/azd/functions-deploy.md:74 references/recipes/azd/functions-deploy.md:77 references/recipes/azd/functions-deploy.md:80 references/recipes/azd/README.md:14 references/recipes/azd/README.md:22 references/recipes/azd/README.md:77 references/recipes/azd/scripts/apply-migrations.sh:47 references/recipes/azd/scripts/apply-migrations.sh:44 references/recipes/azd/scripts/grant-and-migrate.sh:103 references/recipes/azd/scripts/grant-and-migrate.sh:54 references/recipes/azd/scripts/grant-and-migrate.sh:100 references/recipes/bicep/README.md:10 references/recipes/bicep/README.md:16 references/recipes/terraform/errors.md:9 references/recipes/terraform/README.md:11 references/recipes/terraform/README.md:17 references/recipes/terraform/README.md:114 references/sdk/azd-deployment.md:19 references/sdk/azure-identity-dotnet.md:12 references/sdk/azure-identity-dotnet.md:20 references/sdk/azure-identity-java.md:18 references/sdk/azure-identity-java.md:26 references/sdk/azure-identity-py.md:14 references/sdk/azure-identity-py.md:22 references/sdk/azure-identity-ts.md:12 references/sdk/azure-identity-ts.md:20
🌐 网络访问 (23)
references/recipes/azcli/verify.md:10 references/recipes/azcli/verify.md:41 references/recipes/azcli/verify.md:45 references/recipes/azcli/verify.md:49 references/recipes/azcli/verify.md:56 references/recipes/azcli/verify.md:60 references/recipes/azcli/verify.md:64 references/recipes/azd/functions-deploy.md:68 references/recipes/azd/functions-deploy.md:74 references/recipes/azd/functions-deploy.md:77 references/recipes/azd/functions-deploy.md:80 references/recipes/azd/functions-deploy.md:87 references/recipes/azd/verify.md:16 references/recipes/azd/verify.md:68 references/recipes/azd/verify.md:70 references/recipes/bicep/verify.md:18 references/recipes/cicd/verify.md:16 references/recipes/terraform/verify.md:11 references/troubleshooting.md:115 references/troubleshooting.md:116 SKILL.md:45 SKILL.md:70 SKILL.md:74

检测到的模式

Pipe to shell pattern
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/microsoft-azure-deploy/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-azure-deploy/security.svg)](https://skillstore.io/skills/microsoft-azure-deploy?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/microsoft-azure-deploy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-deploy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/microsoft-azure-deploy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

microsoft. (2026). azure-deploy security audit report (audit version 5) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-deploy/audits/5

BibTeX 引用

@techreport{microsoft-microsoft-azure-deploy-2026, author = {microsoft}, title = {azure-deploy security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/microsoft-azure-deploy/audits/5}, note = {Author version 0.0.0-placeholder} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "azure-deploy security audit report (audit version 5)" version: "0.0.0-placeholder" type: report authors: - name: "microsoft" date-released: "2026-07-23" url: "https://skillstore.io/skills/microsoft-azure-deploy/audits/5" identifiers: - type: other value: "skillstore:microsoft-azure-deploy:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
50
架构
90
可维护性
87
内容
73
社区
91
规范符合性

你能构建什么

部署已验证的 Web 应用

在计划、基础设施和环境检查完成后运行最终 Azure 部署。

标准化发布步骤

为团队部署工作流使用可重复的 Azure CLI、azd、Bicep 或 Terraform 配方。

准备管道部署

审查使用 Azure 凭据和受保护环境的 GitHub Actions 与 Azure DevOps 部署模式。

试试这些提示

使用 azd 部署 
使用 azd 将这个已验证的项目部署到 Azure。在运行部署命令前确认订阅和区域。
部署 Bicep 基础设施 
为此项目使用 Bicep 部署配方。在执行前显示计划使用的订阅、位置和部署命令。
通过 CI/CD 发布 
审查我的 Azure 部署管道，并识别所需的密钥、变量、环境保护和验证步骤。
恢复失败的部署 
分析此 Azure 部署失败，将其映射到相关配方，并在重试前提出最安全的恢复步骤。

最佳实践

  • 每次部署前确认订阅、资源组和区域。
  • 在预配生产资源前使用 preview 或 plan 命令。
  • 对破坏性或高成本操作要求用户明确批准。

避免

  • 在验证证明可用前运行部署命令。
  • 在未审查计划的情况下使用 no-prompt 或 auto-approve 标志。
  • 将 Azure 凭据直接嵌入代码、模板或日志中。

常见问题

此技能会从头创建 Azure 应用程序吗？
不会。它用于应用程序准备和验证完成后的最终部署。
此技能可以使用 Azure Developer CLI 进行部署吗？
可以。它包含用于预配、完整部署和仅应用程序部署的 azd 工作流。
它支持 Bicep 和 Terraform 吗？
支持。参考内容包含 Azure CLI、Bicep、Terraform、Azure Functions 和 CI/CD 部署配方。
它会在破坏性操作前询问吗？
该技能指南要求在执行删除、覆盖、清除或高成本操作前获得用户明确确认。
需要哪些凭据？
用户需要通过本地工具、托管标识、服务主体或联合 CI 凭据进行有效的 Azure 身份验证。
为什么此技能需要谨慎使用？
如果清理命令获得批准，它可以运行真实的云部署命令、产生费用并删除资源。

开发者详情

作者

microsoft

许可证

MIT

作者版本

v0.0.0-placeholder

Skillstore 修订

r2

仓库

https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-deploy/

引用

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

维护新鲜度

2026/7/26

使用量

8 次下载 · 372 次浏览

文件结构

📁 references/

📄 auth-best-practices.md

📄 global-rules.md

📄 live-role-verification.md

📄 pre-deploy-checklist.md

📁 recipes/

📁 azcli/

📄 errors.md

📄 README.md

📄 verify.md

📁 azd/

📄 ef-migrations.md

📄 errors.md

📄 functions-deploy.md

📄 post-deployment.md

📄 README.md

📁 scripts/

📄 apply-migrations.ps1

📄 apply-migrations.sh

📄 grant-and-migrate.ps1

📄 grant-and-migrate.sh

📄 sql-entra-auth.md

📄 sql-managed-identity.md

📄 verify.md

📁 bicep/

📄 errors.md

📄 README.md

📄 verify.md

📁 cicd/

📄 errors.md

📁 examples/

📄 azdo-azd.yml

📄 azdo-multistage.yml

📄 github-azd.yml

📄 github-bicep.yml

📄 README.md

📄 verify.md

📄 README.md

📁 terraform/

📄 errors.md

📄 README.md

📄 verify.md

📄 region-availability.md

📁 sdk/

📄 azd-deployment.md

📄 azure-identity-dotnet.md

📄 azure-identity-java.md

📄 azure-identity-py.md

📄 azure-identity-ts.md

📄 troubleshooting.md

📄 SKILL.md

📄 version.json

microsoft 的更多技能

查看全部

相关技能

查看全部