discovery-services-agent-deployer
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Dynamic Script Generation and Execution: The primary PowerShell runner (
deploy-discovery-agent.ps1) dynamically generates and executes several Python scripts (patch_agent_yaml.py,stage-04a-deploy-agent.py,validation_test.py) to handle YAML processing and Azure API interactions. While this is used to consolidate deployment logic, it represents a dynamic execution pattern where logic is stored as strings and written to disk at runtime. - Automated Package Installation: The script automatically attempts to install Python dependencies (
pyyaml,requests) viapipif they are missing. This is a common practice for development tools but introduces a dependency on external package registries at runtime. - Security Configuration Modification: The skill is designed to patch
agent.yamlfiles to sethumanInTheLoopand toolconfirmationfields toDisabledon the deployed resources. This is intended to facilitate automated validation but modifies security controls on the target Azure environment. - Credential Acquisition and Usage: The skill uses the Azure CLI (
az account get-access-token) to acquire tokens for thehttps://discovery.azure.comresource. These tokens are used to authenticate requests to user-configured Azure workspace endpoints. This is standard functionality for an Azure deployment tool but involves the handling of sensitive bearer tokens in memory. - PowerShell Execution Policy Bypass: Instructions and script calls utilize
-ExecutionPolicy Bypass. This is a standard method for executing local scripts in automation environments, though it explicitly sidesteps local script execution restrictions.
Audit Metadata