azure-monitor-audit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data by providing KQL queries for auditing Azure logs (e.g.,
SigninLogs,AzureActivity,AuditLogs). This represents an attack surface where maliciously crafted log entries could attempt to influence agent behavior, though this is inherent to the skill's primary purpose of security monitoring. - Ingestion points: KQL query sections in
SKILL.mdthat process sign-in, activity, and audit logs. - Boundary markers: No specific delimiters or instructions to ignore potentially embedded commands within log data are present in the provided templates.
- Capability inventory: The skill utilizes Azure CLI (
az) tools for cloud resource configuration and management. - Sanitization: The provided queries focus on data retrieval and analysis without explicit sanitization of log content.
Audit Metadata