azure-key-vault
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation from official Microsoft domains (
learn.microsoft.com) usingmcp_microsoftdocs:microsoft_docs_fetchandfetch_webpage. These are well-known, trusted sources for documentation content. - [EXTERNAL_DOWNLOADS]: References the official Microsoft GitHub repository (
github.com/MicrosoftDocs/mcp) for tool installation instructions, which is a trusted source. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted markdown data from external URLs at runtime. However, the risk is minimal as the sources are official documentation portals and the skill's purpose is purely informational.
- Ingestion points: Documentation content fetched from numerous
learn.microsoft.comURLs listed in the Category Index. - Boundary markers: Absent. The skill does not define specific delimiters for the fetched content.
- Capability inventory: No local scripts, subprocess calls, or file-write operations are present in the skill.
- Sanitization: Absent. The agent is instructed to handle the fetched markdown directly.
- [SAFE]: No obfuscation, hardcoded credentials, or persistence mechanisms were detected. The skill's instructions for the agent are clear and aligned with its stated purpose of providing expert guidance on Azure Key Vault.
Audit Metadata