azure-prepare
microsoft/azure-skills
Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up az
1 finding, 1 high severity, in the 101 files we could read.
What it does
- Runs shell commands
- Installs packages
- Reaches aka.ms, aspire.dev, azure.github.io, azure.microsoft.com, central.sonatype.com, database.windows.net, github.com, learn.microsoft.com, localhost, login.microsoftonline.com, mcr.microsoft.com, my-api.azurecontainerapps.io, my-api.example.com, myscheduler-abc123.westus2.durabletask.io, myvault.vault.azure.net, portal.azure.com, pypi.org, redis.azure.com, registry.terraform.io, schema.management.azure.com, www.npmjs.com, www.nuget.org
- Reads ACR_NAME, ACR_SERVER, APP, APPHOST_DIR, APPHOST_PROJECT, APP_NAME, APP_PUBLIC_HOSTNAME, AZURE_APPCONFIG_ENDPOINT, AZURE_APP_ID_URI, AZURE_CLIENT_ID, AZURE_ENV_NAME, AZURE_FUNCTIONS_ENVIRONMENT, AZURE_LOCATION, AZURE_SQL_CONNECTION_STRING, AZURE_SQL_DATABASE, AZURE_SQL_SERVER, AZURE_TENANT_ID, CANARY_REV, CONTAINER_APP_NAME, CONTAINER_NAME, COSMOS_CONNECTION_STRING, COSMOS_CONTAINER_NAME, COSMOS_DATABASE_NAME, COSMOS_ENDPOINT, DATABASE_NAME, ENVIRONMENT, ENV_NAME, EVENTGRID_TOPIC_ENDPOINT, EVENTGRID_TOPIC_KEY, LOCATION, NEW_IMAGE, NEW_REV, NODE_ENV, PLAN, PORT, REDIS_HOST, REDIS_PORT, REPLICA_NAME, RESOURCE_GROUP, REV, RG_NAME, SESSION_SECRET, STABLE_REV, TEMPLATE, THUMBPRINT, TRUSTED_HOST, WEBSITES_PORT, WEBSITE_SITE_NAME
- Writes .azconfig.io, .azurecr.io/, .database.windows.net, /, 1.15.0, 1.2, 1.7.0, 1.8.0, 3.0, 3.2.3, 4.2, com.azure, com.microsoft, com.microsoft.azure.functions, src/frontend/src
Findings (1)
HighDownloads and executes remote code
Code fetched at run time is executed without being reviewed or pinned; whoever controls that URL controls every machine running the skill.
references/sdk/azd-deployment.md:8
Some of the skill's files couldn't be read, so this check may be incomplete.
Decide which skills your team's agents may run
skillsvault scans every skill your organisation uses, blocks the ones you ban on every developer's machine, and keeps a tamper-evident record of every run. Free for one developer.
A deterministic scan of the skill's files as published today; it isn't a guarantee. It reads the files and reports what they do — nothing is run or installed.