cosmosdb-best-practices
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SECURITY_BEST_PRACTICES]: The skill provides high-quality security guidance, including rules for disabling local authentication keys in favor of Azure Entra ID and using managed identities with
DefaultAzureCredentialto eliminate hardcoded secrets. - [INJECTION_PREVENTION]: Multiple rules (e.g.,
query-parameterize.mdandsdk-langchain-js-filter-injection.md) explicitly warn against NoSQL injection vulnerabilities and mandate the use of parameterized queries for all database operations. - [DATA_INTEGRITY]: The skill includes detailed instructions on enforcing uniqueness within partitions, handling JSON serialization to prevent data loss, and implementing ETag-based optimistic concurrency for read-modify-write patterns.
- [EXTERNAL_DOWNLOADS]: The skill references standard, well-known libraries and tools from Microsoft (e.g.,
azure-cosmos,CosmosDBShell,azure-identity). These are treated as safe per the trusted service recognition rules. - [TOOLING_SAFETY]: The documentation for developer tooling (Cosmos DB Shell) includes strict safety protocols for agents, such as requiring user consent for writes/deletions, performing dry runs, and treating database results as data rather than instructions.
Audit Metadata