Security risk report for @forgecat/microsoft-azure_skills-azure-kusto v0.0.5
Source Integrity
Low
Profile claims authorship by Microsoft and references the official microsoft/azure-skills GitHub repository.
No suspicious external URLs, typosquatted dependencies, or attacker-controlled package references detected.
Agent Intent
Low
Content describes legitimate Azure Data Explorer (Kusto) query capabilities and KQL patterns without injecting malicious instructions.
Documentation includes standard best practices (time filtering, query optimization, access control) that strengthen security rather than weaken it.
No instructions to ignore system prompts, exfiltrate credentials, fetch external payloads, or manipulate the AI's behavior.
Details
Evidence
Skill activation triggers are legitimate use cases: 'Query my Kusto database', 'Show me events', 'Analyze logs'.
KQL examples demonstrate standard data retrieval and aggregation patterns without hidden directives.
Best practices section emphasizes security: 'Monitor query performance', 'Apply data retention policies', 'Verify database permissions'.
Permissions
PRM-000Medium
Profile declares four MCP tools (kusto_cluster_list, kusto_database_list, kusto_query, kusto_table_schema_get) that enable broad data access across Azure subscriptions and clusters.
No explicit alwaysApply=true or glob patterns declared, but the skill is designed to activate on any Kusto/ADX mention, potentially granting query authority without explicit user consent per operation.
Fallback strategy documents Azure CLI commands (az kusto, az rest) that could execute arbitrary REST API calls if MCP tools fail, expanding the attack surface.
Details
Evidence
Tool descriptions: 'List all Azure Data Explorer clusters in a subscription' and 'Execute KQL queries against a Kusto database' grant broad read/query access.
Fallback section: 'az rest --method post --url https://<cluster>.<region>.kusto.windows.net/v1/rest/query' allows direct API calls without per-query approval.
Skill activation is trigger-based ('Mentions Kusto, Azure Data Explorer, ADX, or KQL') rather than explicit user request per operation.
MCP Risk
Low
No MCP servers are actually declared in the profile; only tool names and CLI fallback commands are documented.
Tools reference standard Azure SDK operations (cluster listing, database listing, query execution) without hidden instructions or arbitrary binary execution.
Access is scoped to Azure Data Explorer resources within the user's subscription, not unrestricted filesystem or network.
Details
Evidence
MCP Tools Used table lists four named tools with clear, documented purposes and required parameters (subscription, cluster, database, query).
Fallback commands use standard Azure CLI (az kusto, az rest) with explicit URL and body parameters, not shell injection or remote payload execution.
No tool descriptions contain obfuscated instructions, encoded payloads, or references to exfiltration endpoints.
ForgeCat