msresearch-promptions

No malware or obfuscated payload is present in the visible documentation. The main security concern is instructing users to place an Azure API key in a VITE_-prefixed variable for applications that may run in browsers, where the key can be exposed. Use a server-side proxy or server-only credentials and avoid shipping the key in client bundles.

The visible code appears intended to configure Azure OpenAI for two applications, not to perform malware activity. However, placing an Azure API key in a VITE-prefixed variable risks exposing it in client-side bundles, and the fallback prints the key to standard output. Keep the key server-side and assess the omitted write_env implementation and destination handling.