azure-env-builder

SUSPICIOUS. The skill largely matches its Azure environment-building purpose and uses mostly official Microsoft/Azure flows, but it includes several download-and-execute patterns and raw GitHub script execution examples with weak provenance and no verification. No clear credential theft or exfiltration is present, so this is not confirmed malware, but the install/execution trust is broader and riskier than a pure design/reference skill.

No clear malicious behavior is present in the shown fragment. It does contain GitHub Actions shell-injection risks because expressions, including a workflow input, are interpolated into `run` scripts, and deployment outputs are written to `$GITHUB_OUTPUT` without newline-safe handling. Restrict who can provide inputs or modify variables and use environment-variable passing and safe output encoding.