discover-azure-skills
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Retrieval of External Metadata: The skill fetches plugin and skill information from the official Microsoft GitHub repository (
microsoft/azure-skills) using the GitHub Contents API. This allows the agent to dynamically discover available tools. - Indirect Content Processing: The skill reads and evaluates descriptions from remote markdown files to determine relevance. This is a standard functional requirement for a discovery tool, and the use of a trusted source minimizes considerations associated with processing external data.
- Deployment Guidance: The skill provides standardized installation commands for Claude Code, Copilot CLI, and other tools. These instructions guide the user to add the
azure-skillsmarketplace and install plugins from verified Microsoft resources. - Capability Inventory: The skill involves network requests to the GitHub API and raw content domains to fetch documentation and metadata. It does not perform local file writes, subprocess execution, or privilege escalation itself; it provides instructions for the user to perform installation via their agent client.
Audit Metadata