show-password-setup

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script uses the Azure CLI (az) to interact with cloud resources. It writes secrets to Key Vault and updates Web App settings. This behavior is the primary purpose of the skill and requires the executing environment to have pre-existing authenticated Azure credentials.
  • [DATA_EXPOSURE]: The skill manages sensitive information by reading show passwords from user input and storing them in Azure Key Vault. It also modifies local environment mapping files (.env, keyvault_env_map.env). These operations are consistent with its role as a credential management tool and avoid hardcoding secrets.
  • [DYNAMIC_EXECUTION]: The shell script uses an embedded Python snippet to safely update configuration files. This logic is self-contained within the script and performs basic file manipulation to ensure mapping consistency.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided show names and passwords.
  • Ingestion points: User input is captured via interactive shell prompts in scripts/set_show_password.sh.
  • Boundary markers: None (standard interactive shell input).
  • Capability inventory: File writes to local mapping files and command execution via Azure CLI.
  • Sanitization: The show name is normalized (uppercased and non-alphanumeric characters replaced) to prevent shell injection or malformed resource names.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 04:18 PM
Security Audit — agent-trust-hub — show-password-setup