heating the forge...

@forgecat/microsoft-azure_skills-azure-deploy — Security Risk Report | ForgeCat

microsoft-azure_skills-azure-deploy

Security risk report for @forgecat/microsoft-azure_skills-azure-deploy v0.0.4

SRC-010Medium

Static scanner flagged caution level; profile references external Microsoft documentation (learn.microsoft.com) and GitHub repositories (microsoft/azure-skills, nota-america/forgecat-agent-profiles).
Profile claims authorship by Microsoft and references original repository at https://github.com/microsoft/azure-skills with commit hash a990650; no verification of authenticity provided.
Multiple recipe files reference external tools (azd, az CLI, terraform, bicep) and Azure services; supply chain risk is inherent to Azure deployment profiles but mitigated by use of official Microsoft tooling.

Details

Findings

Data exfiltration
skills/azure-deploy/references/recipes/azd/functions-deploy.md · SKILL-002

Low

Profile describes deployment workflows and prerequisites (azure-prepare, azure-validate) without instructing the agent to bypass, ignore, or circumvent them; emphasis on mandatory prerequisite checks and validation gates is defensive.
Content provides legitimate Azure deployment guidance (RBAC patterns, managed identity best practices, EF migrations, error handling) aligned with Microsoft security recommendations; no instructions to exfiltrate credentials, read ~/.ssh/.aws/.env, or hide instructions.
Guidance on authentication (auth-best-practices.md) explicitly recommends secure patterns (ManagedIdentityCredential in production, DefaultAzureCredential for dev only) and warns against insecure fallback chains — this is security-strengthening, not poisoning.

Details

Findings

Invisible characters detected
skills/azure-deploy/references/live-role-verification.md · SKILL-011
Invisible characters detected
skills/azure-deploy/references/pre-deploy-checklist.md · SKILL-011
Invisible characters detected
skills/azure-deploy/references/region-availability.md · SKILL-011
Invisible characters detected
skills/azure-deploy/references/troubleshooting.md · SKILL-011

PRM-000Medium

The skill invokes shell-level deployment commands (azd up, azd deploy, terraform apply, az deployment, az group delete) which constitute high-impact infrastructure operations, though these are consistent with the stated deployment purpose.
MCP tool references (mcp_azure_mcp_subscription_list, mcp_azure_mcp_group_list, mcp_azure_mcp_azd, azure__role) are scoped to Azure management plane operations appropriate for a deployment skill.
The skill's authority is broad by necessity (cloud provisioning inherently touches many resources), but it includes explicit safeguards requiring user confirmation before destructive actions, limiting excessive agency risk.

Details

Evidence

'mcp_azure_mcp_azd | Execute AZD commands' (SKILL.md — MCP Tools table)
'az group delete --name <rg-name> --yes — ⚠️ Permanently deletes ALL resources in the group.' (azcli/errors.md)
'⛔ Destructive actions require ask_user — global-rules.md' (SKILL.md — Rules)

MCP-000Medium

Profile references MCP tools for Azure operations (subscription listing, resource group listing, azd command execution, role assignment queries) without declaring full MCP server definitions in the profile itself; tool descriptions are present but server binaries/endpoints are not specified in the untrusted content.
Tools like `mcp_azure_mcp_azd` and `azure__role` execute cloud commands with broad scope (subscription-level queries, role assignments); these require valid Azure credentials and RBAC permissions, which are external controls.
No hidden instructions in tool descriptions; tool purposes are clearly stated (list subscriptions, execute azd, verify RBAC) and aligned with deployment workflow.

Details

Evidence

SKILL.md MCP Tools table: '`mcp_azure_mcp_subscription_list` | List available subscriptions' — purpose is transparent.
live-role-verification.md: 'azure__role(command: "role_assignment_list", scope: "<resourceId>", assignee_object_id: "<principalId>")' — scoped to specific resource and identity.
No MCP server definitions (binary paths, env credentials, network endpoints) are embedded in the profile content.