The skill permits arbitrary Azure CLI command execution through injection due to insufficient input sanitization, despite a semantic read-
Claims to do
Azure Resource Visualizer - Architecture Diagram Generator: A user may ask for help understanding how individual resources fit together, or to create a diagram showing their relationships. Your mission is to examine Azure resource groups, understand their structure and relationships, and generate comprehensive Mermaid diagrams that clearly illustrate the architecture.
Actually does
This skill uses Azure CLI (`az`) and internal 'Azure MCP tools' to list Azure resource groups, query all resources within a specified group, and analyze their configurations, network settings, and dependencies. It then generates a detailed Mermaid architecture diagram and embeds it into a markdown file, along with a resource inventory and architectural summary.
/plugin marketplace add microsoft/azure-skills/plugin install azure-resource-visualizer@microsoft/azure-skillsgemini extensions install https://github.com/microsoft/azure-skills.git --consentnpx skills add https://github.com/microsoft/azure-skills --skill azure-resource-visualizerThe skill explicitly instructs the agent to use the `az` (Azure CLI) command-line tool for complex queries. While examples provided are read-only, the general instruction to use `az` without strict input sanitization or command whitelisting could allow for arbitrary command execution if an attacker can inject into the command string.
Use Azure CLI for complex queries not available via MCP Example: `az resource list --resource-group <name> --output json`
The skill explicitly states a 'read-only analysis' constraint, which is a positive guideline. However, this is a semantic instruction to the agent, not a technical enforcement, and could be bypassed by a compromised agent capable of executing arbitrary `az` commands.
Never Do: Modify or delete Azure resources (read-only analysis)
[](https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-resource-visualizer)<a href="https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/azure-resource-visualizer"><img src="https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-resource-visualizer.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/azure-resource-visualizer.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.