azure-devops-cli
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official Homebrew installation script from the GitHub repository
raw.githubusercontent.com/Homebrew/install/HEAD/install.sh. This is a well-known and trusted source for software installation. - [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage software installations (
brew install), configure system environment variables (eval shellenv), and interact with the Azure CLI (az extension add,az login). - [PROMPT_INJECTION]: The skill processes external data (Azure DevOps organization URL and project name) that could potentially contain malicious instructions.
- Ingestion points: User-provided
<ORG_URL>and<PROJECT_NAME>strings in Step 5. - Boundary markers: Absent; the inputs are directly interpolated into the
az devops configurecommand. - Capability inventory: The skill has capabilities to execute shell commands and modify local configurations via the Azure CLI.
- Sanitization: Absent; there is no evidence of input validation or escaping for the user-provided configuration strings.
Audit Metadata