Azure Validate

The skill instructs the agent to execute infrastructure CLI commands (azd provision --preview, bicep build, terraform validate, etc.) as part of the validation flow. While described as read-only/preview operations, the pattern establishes a precedent for direct CLI execution that, combined with the external file injection vectors above, could be escalated to arbitrary command execution.

1. Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.)

Step 9 and the mandatory next-step callout instruct the agent to automatically invoke the 'azure-deploy' skill after validation completes, without requiring explicit user confirmation at that transition point. This creates an autonomy chain where a deployment action (potentially infrastructure-modifying) is triggered automatically by the validation skill.

| 9 | **Deploy** — Invoke **azure-deploy** skill | — |
...
> After ALL validations pass, you **MUST** invoke **azure-deploy** to execute the deployment.

The skill reads from and writes to '.azure/deployment-plan.md', a file that could be attacker-controlled or tampered with. The agent reads configuration and recipe instructions from this file before executing validation commands, making it an indirect prompt injection surface if the file contents can be manipulated.

| 1 | **Load Plan** — Read `.azure/deployment-plan.md` for recipe and configuration.