The Agent Skills Directory

Security Best Practices Integration: The skill enforces the use of Microsoft Entra ID (Workload Identity) for accessing Azure resources like Key Vault, PostgreSQL, and Storage. This approach avoids the risks associated with long-lived static credentials by utilizing short-lived OIDC tokens.
Hardened Container Configuration: Templates for Dockerfiles and Kubernetes manifests include mandatory security settings such as runAsNonRoot: true, readOnlyRootFilesystem: true, and dropping all capabilities (capabilities.drop: ["ALL"]). These configurations satisfy the AKS Deployment Safeguards (DS001–DS013) and align with Pod Security Standards (Baseline).
Readiness Assessment Guardrails: The AKS Automatic readiness tool is designed with a "read-only" posture, ensuring it only assesses cluster state without making unauthorized changes. It explicitly instructs the agent not to handle or display secret values or sensitive environment variables during the assessment process.
Trusted Supply Chain: The skill references official and signed base images from Microsoft (MCR) and well-known providers like the Eclipse Temurin project and Google's distroless images. It provides guidance on resolving and pinning images to stable major tags to ensure a balance between security patching and environment stability.
Indirect Prompt Injection Surface: Because the skill processes user-provided Kubernetes manifests for compatibility assessment, there is a theoretical surface for indirect prompt injection within those manifests. However, this is a standard consideration for diagnostic tools, and the risk is mitigated by the skill's structured analysis workflow and the requirement for explicit human review and approval before applying any suggested fixes.

azure-kubernetes