discovery-services-agent-deployer

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • Dynamic Script Generation and Execution: The primary PowerShell runner (deploy-discovery-agent.ps1) dynamically generates and executes several Python scripts (patch_agent_yaml.py, stage-04a-deploy-agent.py, validation_test.py) to handle YAML processing and Azure API interactions. While this is used to consolidate deployment logic, it represents a dynamic execution pattern where logic is stored as strings and written to disk at runtime.
  • Automated Package Installation: The script automatically attempts to install Python dependencies (pyyaml, requests) via pip if they are missing. This is a common practice for development tools but introduces a dependency on external package registries at runtime.
  • Security Configuration Modification: The skill is designed to patch agent.yaml files to set humanInTheLoop and tool confirmation fields to Disabled on the deployed resources. This is intended to facilitate automated validation but modifies security controls on the target Azure environment.
  • Credential Acquisition and Usage: The skill uses the Azure CLI (az account get-access-token) to acquire tokens for the https://discovery.azure.com resource. These tokens are used to authenticate requests to user-configured Azure workspace endpoints. This is standard functionality for an Azure deployment tool but involves the handling of sensitive bearer tokens in memory.
  • PowerShell Execution Policy Bypass: Instructions and script calls utilize -ExecutionPolicy Bypass. This is a standard method for executing local scripts in automation environments, though it explicitly sidesteps local script execution restrictions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 10:58 PM