pipeline-migration

Pass

Audited by Gen Agent Trust Hub on Jul 10, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [Command Execution]: The skill uses the Azure CLI (az) to automate resource discovery, token acquisition, and API interactions. This is standard behavior for infrastructure-as-code and migration tools provided by Microsoft. The commands are constructed using hardcoded parameters and auto-discovered IDs, minimizing the risk of arbitrary command injection.
  • [Authorized Network Operations]: All network operations are directed toward official Microsoft service endpoints (e.g., api.fabric.microsoft.com, management.azure.com, dev.azuresynapse.net). These communications are used to fetch pipeline definitions from the source environment and deploy them to the target environment.
  • [Credential Management Best Practices]: The skill documentation explicitly provides guidance on secret hygiene. It recommends the use of Workspace Identity (Managed Identity) for authentication and demonstrates how to use the 'secureInput' and 'secureOutput' properties in pipeline activities to prevent sensitive data from being logged in run history. It also provides secure methods for passing secrets to CLI commands via file redirection or environment variables.
  • [Data Transformation]: The provided Python scripts perform structural transformations on JSON artifacts. These operations include mapping Synapse activity types to Fabric equivalents, inlining dataset properties, and updating expression syntax. All transformations are performed locally using standard libraries (json, base64, re, copy) and do not involve the execution of untrusted code.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 10, 2026, 02:44 PM
Security Audit — agent-trust-hub — pipeline-migration