azure-keyvault-keys-ts
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes official and trusted packages from Microsoft (@azure/keyvault-keys, @azure/keyvault-secrets, and @azure/identity) for all operations, which are recognized as safe dependencies.
- [SAFE]: Authentication is implemented using DefaultAzureCredential, the recommended secure method for managing Azure identity across development and production environments.
- [SAFE]: The code samples promote security best practices such as enabling soft-delete, utilizing key rotation policies, and implementing least-privilege access by specifying required key operations (e.g., encrypt, sign).
- [INDIRECT_PROMPT_INJECTION]: The skill creates a data ingestion surface by reading secrets and keys from an external managed service (Azure Key Vault). While this is the primary purpose of the skill, it is noted that data retrieved from external sources enters the agent's context. Evidence: Ingestion points found in
SKILL.md(e.g.,secretClient.getSecret("MySecret")). Boundary markers are absent in the code samples, but this is standard for SDK documentation. Sanitization is not applicable as the skill facilitates raw data retrieval for cryptographic use.
Audit Metadata