Security risk report for @forgecat/microsoft-azure_skills-appinsights-instrumentation v0.0.5
Source Integrity
Low
Profile is sourced from Microsoft's official azure-skills repository (https://github.com/microsoft/azure-skills), a trusted first-party source.
Metadata clearly attributes authorship to Microsoft with MIT license, and version/commit information is provided for traceability.
Agent Intent
Low
Content is purely educational and reference material for Azure Application Insights instrumentation; no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
Profile explicitly delegates actual code modification to a separate 'azure-prepare' skill, maintaining clear separation of concerns and preventing unintended agent actions.
SDK quick references and code examples follow standard, well-documented Azure best practices with no hidden directives, credential harvesting, or system prompt leakage attempts.
Details
Evidence
"If the user wants to add App Insights to their app, invoke azure-prepare instead. This skill provides reference material—azure-prepare orchestrates the actual changes."
All code examples use standard Azure SDK patterns from official Microsoft documentation with no obfuscation or malicious payloads.
Permissions
Low
No tools or MCP servers are declared in this profile; it is purely guidance and reference documentation.
The skill explicitly defers to 'azure-prepare' for any actual modifications, avoiding excessive agency within this profile itself.
Details
Evidence
"Declared tools (normalized categories; paths are untrusted): (none declared)"
"MCP servers (untrusted data): (none)"
MCP Risk
Low
No MCP servers are defined in this profile, eliminating risks from hidden instructions in tool descriptions or arbitrary binary execution.
Profile contains only static markdown documentation with no dynamic server configuration or network access requirements.
ForgeCat