40Medium
The skill risks command injection by executing external tools with potentially unsanitized user input.
Behavior Analysis
Description verified — behavior matches claim
Claims to do
Azure Compliance & Security Auditing: | Property | Details | |---|---| | Best for | Compliance scans, security audits, Key Vault expiration checks | | Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring | | MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
Actually does
The skill utilizes internal MCP tools to execute `azqr` for comprehensive Azure resource assessments, list Azure subscriptions and resource groups, and inspect Azure Key Vault. It retrieves metadata for Key Vault keys, secrets, and certificates, specifically checking for expiration dates.
Skill Info
Namemicrosoft/azure-skills/azure-compliance
Registrygithub
Version3d8788273dee
PURLpkg:github/microsoft/azure-skills@3d8788273dee?skill=azure-compliance
Stars633
Installs174,500
Source
SHA-2568c0c3e4c8041...
SHA-1815ea5bc9e95...
MD522ab12a4f205...
TLSH38a15687471d...
ssdeep96:IH+jNA5mA...
Size4,739 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Claude CodeDocs
/plugin marketplace add microsoft/azure-skills/plugin install azure-compliance@microsoft/azure-skills
Gemini CLIDocs
gemini extensions install https://github.com/microsoft/azure-skills.git --consent
Skills.shDocs
npx skills add https://github.com/microsoft/azure-skills --skill azure-complianceAssessments (1)
AI Agent Traps ↗Execution of external compliance tool (`azqr`)mediumcommand execution
The skill is designed to run the `azqr` compliance tool. While `azqr` is legitimate, executing external command-line tools introduces a risk of command injection if user input is passed unsanitized, or if the tool itself has exploitable vulnerabilities.
70% confidenceline 58
`mcp_azure_mcp_extension_azqr`
Dependencies (1)
azure.claude-plugin/marketplace.jsonnot scanned
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-compliance)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-compliance"><img src="https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-compliance.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-compliance.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow