azureml-scaffolding
Warn
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The Makefile uses user-supplied variables (pkg, pipe, ARGS, AML_ARGS) directly in shell commands such as 'uv run' and 'az ml job create'. This creates a surface for potential command injection because the variables are not sanitized or escaped before execution.
- [EXTERNAL_DOWNLOADS]: The skill downloads the uv package manager from the official GitHub Container Registry (ghcr.io/astral-sh/uv) and suggests installing packages from Microsoft's official repository (packages.microsoft.com). These downloads are from trusted vendors and well-known services.
Audit Metadata