azure-cloud-architect
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No malicious injection patterns or attempts to override system behavior were found. The instructional language is benign and focused on cloud architecture guidance.- [DATA_EXFILTRATION]: No network activity or exfiltration patterns were identified. The scripts operate exclusively on local data and do not contain hardcoded credentials or sensitive file paths.- [REMOTE_CODE_EXECUTION]: The provided Python scripts (azure_architecture_validator.py, azure_cost_estimator.py, azure_waf_scorer.py) rely solely on the Python standard library and do not execute remote code or download external dependencies.- [INDIRECT_PROMPT_INJECTION]: The skill processes external infrastructure-as-code and configuration files, which is an expected surface for this type of tool.
- Ingestion points: The scripts azure_architecture_validator.py, azure_cost_estimator.py, and azure_waf_scorer.py ingest user-provided Bicep, ARM, and YAML configuration files.
- Boundary markers: None; the scripts read the raw text of the files provided via CLI arguments.
- Capability inventory: Scripts perform regex matching, arithmetic, and basic parsing for local report generation. They lack network access, subprocess spawning, or arbitrary file system write capabilities (except user-directed --output).
- Sanitization: The scripts use a manual state-machine parser and standard library regex, avoiding dangerous evaluation functions like eval() or exec().- [DYNAMIC_EXECUTION]: No dynamic code generation or unsafe deserialization (such as pickle) was found. The scripts use a custom, limited YAML parser for safety.
Audit Metadata