40Medium
The skill deceptively provides actionable Azure CLI and Bicep commands for resource creation and code modification, contradicting its stated purpose.
Behavior Analysis
Mismatch detected — The skill explicitly states it only provides 'guidance and reference material' and that `azure-prepare` should be used for 'adding components' or 'orchestrating actual changes.' However, it then provides detailed instructions, including Azure CLI commands and Bicep examples, for creating App Insights resources and modifying application code, which constitutes 'adding components' and 'actual changes.'
Claims to do
AppInsights Instrumentation Guide: This skill provides **guidance and reference material** for instrumenting webapps with Azure Application Insights.
Actually does
This skill reads the user's application source code to identify its language and framework. It then provides guidance, code examples, and Azure CLI commands (from `scripts/appinsights.ps1`) to the user for creating an Azure Application Insights resource and modifying their application's code (referencing local markdown files like `references/aspnetcore.md` or `references/nodejs.md`) for instrumentation. It also points to SDK quick references.
Skill Info
Namemicrosoft/github-copilot-for-azure/appinsights-instrumentation
Registrygithub
Version771a66600a0c
PURLpkg:github/microsoft/github-copilot-for-azure@771a66600a0c?skill=appinsights-instrumentation
Stars202
Installs154,000
Source
SHA-2562ccbeea57f2a...
SHA-1c16d4682463e...
MD5c84b1e21991b...
TLSH3d71749a2f21...
Size3,646 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Skills.shDocs
npx skills add https://github.com/microsoft/github-copilot-for-azureAssessments (1)
AI Agent Traps ↗Description Mismatchmediumdescription mismatch
The skill explicitly states it only provides 'guidance and reference material' and that `azure-prepare` should be used for 'adding components' or 'orchestrating actual changes.' However, it then provides detailed instructions, including Azure CLI commands and Bicep examples, for creating App Insights resources and modifying application code, which constitutes 'adding components' and 'actual changes.'
85% confidence
Stated: 'If the user wants to add App Insights to their app, invoke azure-prepare instead. This skill provides reference material—azure-prepare orchestrates the actual changes.' Actual: 'Manually instrument... Create AppInsights resource... Use Azure CLI. See [scripts/appinsights.ps1] for what Azure CLI command to execute... Modify application code... see [ASPNETCORE guide] for how to modify the C# code.'
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/microsoft/github-copilot-for-azure/appinsights-instrumentation)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/microsoft/github-copilot-for-azure/appinsights-instrumentation"><img src="https://mondoo.com/ai-agent-security/api/badge/github/microsoft/github-copilot-for-azure/appinsights-instrumentation.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/microsoft/github-copilot-for-azure/appinsights-instrumentation.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow