azure-app-onboard
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill utilizes shell commands (PowerShell/Bash) and the Azure CLI to provision and manage cloud resources. These operations are core to the skill's purpose and are conducted through the user's authenticated session.
- Sub-agent Delegation: To maintain security and prevent context leakage, the skill delegates complex tasks like IaC generation and review to isolated sub-agents using clear boundary markers, which is a recommended pattern for processing potentially untrusted data.
- Infrastructure Conformance: It includes deterministic conformance scripts to check generated Bicep and Terraform code for security considerations and ARM-compatibility before any deployment action is taken.
- Credential Hygiene: The skill enforces the use of Azure Key Vault for secrets and Managed Identity for service-to-service authentication, explicitly blocking patterns that involve hardcoded credentials or plaintext secrets in infrastructure files.
- Trusted External Dependencies: It downloads necessary utilities, such as the Static Web Apps CLI, from official and well-known registries (NPM).
Audit Metadata