aro-kusto-arm
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a detailed investigation workflow and Kusto Query Language (KQL) templates for analyzing Azure Resource Manager telemetry. No malicious patterns, obfuscation, or unauthorized data exfiltration were detected.
- [EXTERNAL_DOWNLOADS]: The skill references official Microsoft Azure Kusto cluster endpoints (e.g.,
armprodeus.eastus.kusto.windows.net). These are well-known and legitimate service endpoints for the documented task of log analysis. - [COMMAND_EXECUTION]: The skill utilizes the
shelltool as declared in the frontmatter. This is intended for executing KQL queries via authorized CLI tools (aro-kusto) to retrieve logs from the specified internal Microsoft clusters. - [INDIRECT_PROMPT_INJECTION]: The KQL recipes ingest user-provided identifiers (e.g., Correlation IDs, Resource IDs) into query templates. While this represents a standard injection surface, the skill is focused on log analysis within a controlled environment, and there is no evidence of malicious intent or safety bypass instructions.
Audit Metadata