azure-app-onboard

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [Command Execution]: The skill utilizes Azure CLI commands (az deployment, az webapp, az acr, az staticwebapp) to manage cloud resources. These commands are integral to the skill's purpose of automating Azure onboarding and deployment.
  • [Validation Scripts]: The skill includes internal PowerShell and Bash scripts (scaffold-conformance.ps1, scaffold-conformance.sh) to perform semantic validation of generated infrastructure-as-code files. This is a security-enhancing feature designed to catch misconfigurations before deployment.
  • [External Tools]: The skill uses npx to execute the @azure/static-web-apps-cli and Invoke-WebRequest to interact with the Azure Kudu API for zip deployments. These operations target official Microsoft services and tools required for the deployment process.
  • [Credential Management]: The skill follows security best practices by generating secrets at runtime and storing them in Azure Key Vault. It explicitly blocks the inclusion of plaintext secrets in generated templates and provides mechanisms for secure parameter handling during deployment.
  • [Data Access]: The skill fetches retail pricing data from prices.azure.com to generate cost estimates for planned architectures. This interaction is restricted to official vendor endpoints and is necessary for the skill's cost estimation feature.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 05:14 PM
Security Audit — agent-trust-hub — azure-app-onboard