The Agent Skills Directory

Command Execution: The skill performs extensive operations via the Azure CLI (az), PowerShell, and Bash to manage infrastructure and application deployment. While these are high-privilege operations, the skill implements a comprehensive blocked-patterns.md list to prevent destructive commands (e.g., rm -rf, az group delete) and requires explicit user approval before executing any deployment or significant configuration change.
External Resource Access: The skill interacts with well-known Azure services including the Retail Prices API (prices.azure.com) for cost estimation and the Azure Resource Manager API (management.azure.com) for deployment. It also utilizes the @azure/static-web-apps-cli from the official NPM registry. These downloads and API interactions originate from trusted sources and are essential for the skill's primary function of cloud resource management.
Indirect Prompt Injection Surface: As an orchestrator that analyzes user codebases (including Dockerfiles, .env files, and project manifests), the skill has an inherent exposure to indirect prompt injection. A malicious codebase could theoretically contain instructions designed to influence the agent's behavior. The skill mitigates this risk by using isolated 'task' sub-agents with strict template-based prompts and boundary delimiters (<<<TEMPLATE_START>>>), as well as deterministic conformance scripts (scaffold-conformance.ps1) to validate generated infrastructure code against security baselines.
Dynamic Infrastructure Generation: The skill generates infrastructure-as-code (Bicep or Terraform) based on its analysis of the application. This generated code is then executed to provision resources. The skill ensures safety through a multi-layered self-review process (L1-L4) that checks for security contradictions, hallucinated API versions, and alignment with the Azure Well-Architected Framework (WAF) before any code is deployed.
Credential Management: The skill follows industry best practices by enforcing the use of Azure Key Vault for all secrets and System-Assigned Managed Identities for service-to-service authentication. It explicitly forbids the hardcoding of secrets in generated files and uses @secure() Bicep parameters to handle sensitive values during the deployment lifecycle.

azure-app-onboard