External markdown files for core workflows introduce a supply chain risk, enabling arbitrary code execution if compromised.
Claims to do
Azure Cost Management Skill: Unified skill for all Azure cost management tasks: querying historical costs, forecasting future spending, and optimizing to reduce waste.
Actually does
This skill queries Azure Cost Management API endpoints (`/query`, `/forecast`) using `az rest` to retrieve historical costs and forecast future spending. It also uses `az monitor metrics list` and `az resource list` to gather data for cost optimization. Additionally, it leverages internal tools like `azure__documentation`, `azure__extension_cli_generate`, `azure__get_azure_bestpractices`, `azure__extension_azqr`, and `azure__aks` to assist with analysis, command generation, and identifying optimization opportunities.
The skill's core workflows (Cost Query, Cost Optimization, Cost Forecast) are defined in external markdown files. This introduces a supply chain risk, as compromise or malicious content within these external files could lead to arbitrary code execution or other forms of attack.
[Cost Query Workflow](cost-query/workflow.md), [Cost Optimization Workflow](cost-optimization/workflow.md), [Cost Forecast Workflow](cost-forecast/workflow.md)
[](https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-cost)<a href="https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-cost"><img src="https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-cost.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-cost.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.