heating the forge...

@forgecat/microsoft-azure_skills-azure-hosted-copilot-sdk — Security Risk Report | ForgeCat

microsoft-azure_skills-azure-hosted-copilot-sdk

Security risk report for @forgecat/microsoft-azure_skills-azure-hosted-copilot-sdk v0.0.4

Low

Profile is sourced from Microsoft's official azure-skills repository (https://github.com/microsoft/azure-skills) with MIT license and clear attribution.
Static scanner confirmed safe level; no typosquatted, attacker-controlled, or suspicious package sources are referenced.
All external references (GitHub Copilot SDK, Azure samples, Microsoft Learn docs) are to legitimate, well-known Microsoft and GitHub resources.

Low

Profile contains legitimate technical guidance for deploying Copilot SDK apps on Azure; no instructions to ignore system prompts, read credentials, exfiltrate data, or install malicious payloads.
References to `DefaultAzureCredential` and `ManagedIdentityCredential` are standard Azure SDK authentication patterns, not guidance poisoning — they strengthen security by discouraging hardcoded secrets.
Codebase detection logic (scanning for `@github/copilot-sdk`, `CopilotClient`, etc.) is a legitimate routing mechanism to select the correct skill, not a prompt injection or hidden instruction.
All code examples follow Microsoft best practices; no typosquatted packages, disabled TLS verification, or security-weakening defaults are introduced.

Details

Findings

Invisible characters detected
skills/azure-hosted-copilot-sdk/SKILL.md · SKILL-011
Invisible characters detected
skills/azure-hosted-copilot-sdk/references/azure-model-config.md · SKILL-011
Invisible characters detected
skills/azure-hosted-copilot-sdk/references/copilot-sdk.md · SKILL-011
Invisible characters detected
skills/azure-hosted-copilot-sdk/references/deploy-existing.md · SKILL-011
Invisible characters detected
skills/azure-hosted-copilot-sdk/references/existing-project-integration.md · SKILL-011

Evidence

"Use managed identity for all Azure-hosted apps" and "Never hardcode credentials, connection strings, or keys" — defensive security guidance.
"DefaultAzureCredential is for local development. See auth-best-practices.md for production patterns" — correctly separates dev and prod auth.
"Do NOT use `responses` — breaks multi-turn tool calls" — technical constraint documentation, not manipulation.

Low

Profile declares no tools, hooks, or MCP servers with file_write, file_delete, shell, or other high-risk categories.
Guidance references legitimate Azure CLI (`az`), GitHub CLI (`gh`), and Docker commands as part of standard deployment workflows — not excessive authority.
Instructions to read `package.json`, `.ts`, `.js` files are scoped to codebase detection and are appropriate for a deployment skill.

Details

Evidence

"Read `package.json` in the workspace root" — scoped file read for detection, not mutation.
"azd init --template azure-samples/copilot-sdk-service" — invokes standard Azure Developer CLI, not arbitrary shell execution.
No `alwaysApply=true` rules, no `globs="**"` wildcards, no unrestricted file or network access declared.

Low

Profile declares no MCP servers; references to `github-mcp-server-get_file_contents` and `context7-resolve-library-id` are optional helper tools mentioned in documentation, not embedded or required.
Guidance to install `@upstash/context7-mcp` is optional and user-initiated, not a hidden dependency or auto-executed payload.
No arbitrary binary execution, unrestricted network access, or hidden instructions in tool descriptions.

Details

Evidence

"If context7 is not installed, instruct the user to add it" — user choice, not mandatory or auto-installed.
"npx -y @upstash/context7-mcp@latest" — transparent, user-visible command; no obfuscation.
No MCP server definitions in the profile; all references are to well-known, legitimate services (GitHub, Upstash).