100Critical
This skill exposes sensitive credentials, allows privilege escalation, arbitrary
Behavior Analysis
Description verified — behavior matches claim
Claims to do
Microsoft Foundry Skill: This skill helps developers work with Microsoft Foundry resources, covering model discovery and deployment, complete dev lifecycle of AI agent, evaluation workflows, and troubleshooting.
Actually does
This skill orchestrates various sub-skills to manage Microsoft Foundry resources. It uses Microsoft Control Plane (MCP) tools, `ask_user`/`askQuestions` for user interaction, and potentially `azd` and Azure CLI commands. It reads configuration from `.foundry/agent-metadata.yaml` and `azure.yaml`, interacts with Azure Container Registry, and manages Azure AI Foundry projects, agents, models, and related Azure resources.
Skill Info
Namemicrosoft/azure-skills/microsoft-foundry
Registrygithub
Version992cd5d3a770
PURLpkg:github/microsoft/azure-skills@992cd5d3a770?skill=microsoft-foundry
Stars849
Installs303,900
Source
SHA-256a917f6f7eadd...
SHA-1ef858eb7a783...
MD57369e0ce55b8...
TLSHfa32e8afbd52...
ssdeep192:FG/smmKD...
Size11,530 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Assessments (2)
AI Agent Traps ↗Command Execution & Credential Harvestingcriticalcommand execution
The skill explicitly mentions executing `azd env get-values` and using `Azure CLI` for resource creation. `azd env get-values` retrieves environment variables, which often contain sensitive credentials, posing a direct risk of command execution and credential harvesting.
100% confidenceline 120
run `azd env get-values` and use it to seed `agent-metadata.yaml`... Creating Azure AI Services multi-service resource (Foundry resource) using Azure CLI.
Privilege Escalation via RBAC Managementhighprivilege escalation
The 'rbac' sub-skill is designed for 'Managing RBAC permissions, role assignments, managed identities, and service principals'. If an attacker can control the parameters to these operations, it presents a direct path to privilege escalation.
90% confidenceline 33
rbac | Managing RBAC permissions, role assignments, managed identities, and service principals for Microsoft Foundry resources.
Sub-Agent Spawninghighsub agent spawning
The skill explicitly instructs to 'Use the `task` or `runSubagent` tool to delegate long-running or independent sub-tasks'. This allows for spawning sub-agents, which could be used to execute attacker-controlled prompts or logic.
100% confidenceline 145
Use the `task` or `runSubagent` tool to delegate long-running or independent sub-tasks
Reconnaissance Capabilitiesmediumreconnaissance
The skill can perform 'env var scanning' via `runSubagent`, retrieve `AZURE_SUBSCRIPTION_ID` and registry names via `azd env get-values`, and access container logs and telemetry via 'trace' and 'troubleshoot' sub-skills, providing extensive reconnaissance capabilities.
90% confidenceline 26
runSubagent tool to delegate... env var scanning... AZURE_SUBSCRIPTION_ID... trace | Query traces... troubleshoot | View container logs, query telemetry
Resource Provisioning and Abusemediumresource abuse
The skill enables deploying agents, creating Azure AI Foundry projects, and provisioning Azure AI Services resources. If misused, these capabilities could lead to unauthorized resource consumption, financial impact, or denial of service.
80% confidenceline 38
deploy | Containerize, build, push to ACR, create/update/start/stop/clone agent deployments... project/create | Creating a new Azure AI Foundry project... resource/create | Creating Azure AI Services multi-service resource
Cognitive State Manipulation via Configuration Filesmediummemory poisoning
The `agent-metadata.yaml` file is described as the 'required source of truth' for environment-specific project settings. If an attacker can manipulate this file, they could poison the agent's understanding of its operational context, leading to altered behavior or misconfigurations.
80% confidenceline 70
`agent-metadata.yaml` is the required source of truth for environment-specific project settings
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/microsoft-foundry)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/microsoft/azure-skills/microsoft-foundry"><img src="https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/microsoft-foundry.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/microsoft/azure-skills/microsoft-foundry.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow