azure-deploy

Pass

Audited by Gen Agent Trust Hub on Apr 5, 2026

Risk Level: SAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Fetches and executes the Azure Developer CLI installation script from Microsoft's official 'aka.ms' redirection service.
  • [COMMAND_EXECUTION]: Orchestrates deployment workflows by executing shell commands for Azure CLI, Azure Developer CLI, Terraform, and .NET Entity Framework migrations.
  • [DYNAMIC_EXECUTION]: Employs the eval command to dynamically load environment variables exported by the azd env get-values tool into the shell environment for database migration scripts.
  • [SAFE]: Incorporates global safety rules that mandate the use of the ask_user tool for any destructive operation, such as resource group deletion or environment destruction via azd down.
  • [SAFE]: Implements a strict validation chain (azure-prepare -> azure-validate -> azure-deploy) to ensure infrastructure plans are verified before execution.
  • [SAFE]: Provides comprehensive guidance on authentication best practices, specifically discouraging the use of the broader DefaultAzureCredential in production in favor of scoped managed identities.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 5, 2026, 06:41 PM
Security Audit — agent-trust-hub — azure-deploy