azure-provision

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses execFileSync to interact with a local vault utility located at ~/.local/bin/vault. This tool is used to retrieve and store sensitive credentials like service principal secrets and resource keys without exposing them in the process list or logs.
  • [EXTERNAL_DOWNLOADS]: The skill performs authenticated network requests to well-known and trusted Microsoft services, including the Microsoft Graph API (graph.microsoft.com), Azure Resource Manager (management.azure.com), and Microsoft Identity platforms (login.microsoftonline.com). These connections are used solely for identity management and infrastructure provisioning.
  • [SAFE]: The skill implements strong security practices, including the use of localized browser sessions to capture tokens, verification of identity claims before execution, and the immediate purging of temporary browser artifacts like screenshots to prevent accidental data exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 05:06 PM
Security Audit — agent-trust-hub — azure-provision