40Medium
The skill introduces supply chain risks through external dependencies and local file loading, potentially influencing agent reasoning if compromised.
Behavior Analysis
Description verified — behavior matches claim
Claims to do
Azure Cloud Migrate: > This skill handles **assessment and code migration** of existing cloud workloads to Azure.
Actually does
This skill uses internal Microsoft Copilot (MCP) tools (`mcp_azure_mcp_get_azure_bestpractices`, `mcp_azure_mcp_documentation`) to analyze source code and configurations for migrating cloud workloads (e.g., AWS Lambda, Fargate, Kubernetes, GCP Cloud Run) to Azure services (Functions, Container Apps). It generates assessment reports, converts code/config based on scenario-specific guides, and outputs results to a dedicated directory, then hands off to another skill for deployment.
Skill Info
Namemicrosoft/azure-skills/azure-cloud-migrate
Registrygithub
Versioneb84d07b5490
PURLpkg:github/microsoft/azure-skills@eb84d07b5490?skill=azure-cloud-migrate
Stars849
Installs292,800
Source
SHA-256aa8ca90871e2...
SHA-147b6a4c133c5...
MD5087dc9620e73...
TLSHc46110097b41...
Size3,406 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Assessments (2)
AI Agent Traps ↗Reliance on External Tools and Sub-Skillsmediumtool poisoning
The skill relies on external `mcp_azure_mcp_` tools and delegates tasks to another skill (`azure-prepare`), introducing potential supply chain vulnerabilities if these dependencies are compromised.
90% confidenceline 19
Use `mcp_azure_mcp_get_azure_bestpractices` and `mcp_azure_mcp_documentation` MCP tools, Hand off to azure-prepare
Loading Local Reference Contentlowrag poisoning
The skill loads scenario-specific rules and guides from local markdown files, which could be a vector for influencing agent reasoning if the skill's package is compromised.
70% confidenceline 29
[lambda-to-functions.md](references/services/functions/lambda-to-functions.md), [assessment](references/services/functions/assessment.md), Load the scenario reference and follow its rules
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-cloud-migrate)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-cloud-migrate"><img src="https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-cloud-migrate.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-cloud-migrate.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow