az-cost-optimize
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from external Azure resource configurations and logs, which is then used to generate GitHub issues.
- Ingestion points: Data enters the agent context through
az resource listresults (resource names and tags), IaC files (Bicep, Terraform, JSON) found viafile_search, and application logs retrieved viaazmcp-monitor-log-query. - Boundary markers: Absent. The instructions do not specify any delimiters or safety markers to isolate the retrieved Azure data from the instructions used to generate issue content.
- Capability inventory: The skill utilizes the
create_issuetool to post generated content to a GitHub repository. - Sanitization: Absent. There is no requirement for the agent to validate or escape external content (like resource names or log messages) before interpolating it into the final recommendations.
- Risk: An attacker with control over Azure resource names, tags, or the ability to generate specific application logs could inject malicious instructions that manipulate the "Implementation" section of the resulting GitHub issues, potentially tricking a developer into executing unsafe CLI commands.
Audit Metadata