arm-templates
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official Azure CLI installation script from Microsoft's 'aka.ms' domain.
- Evidence:
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bashinSKILL.md. - [COMMAND_EXECUTION]: Executes standard Azure CLI (
az) and Bicep commands to manage resource deployments, validate templates, and perform What-If analysis. - Evidence: Usage of
az deployment group create,az bicep install, andaz group exportinSKILL.md. - [PRIVILEGE_ESCALATION]: The Azure CLI installation process utilizes
sudoto install the package at the system level. - Evidence:
sudo bashin the installation snippet inSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined parameters for infrastructure deployment, which represents a surface for indirect injection. However, the use of structured parameter files and standard CLI tools mitigates this risk.
- Ingestion points: Deployment command parameters (
--parameters) inSKILL.md. - Boundary markers: Not explicitly defined in the bash snippets, but the tool uses structured JSON for parameters.
- Capability inventory: Capability to execute shell commands and modify cloud infrastructure via the Azure CLI.
- Sanitization: Not explicitly implemented in the provided shell snippets, relying on the Azure CLI's internal handling.
Audit Metadata