heating the forge...

@forgecat/microsoft-azure_skills-azure-observability — Security Risk Report | ForgeCat

microsoft-azure_skills-azure-observability

Security risk report for @forgecat/microsoft-azure_skills-azure-observability v0.0.4

Low

Static scanner assigned safe level; profile is sourced from Microsoft's official azure-skills repository (https://github.com/microsoft/azure-skills) with MIT license and documented commit hash (a990650).
Metadata clearly attributes authorship to Microsoft and references the upstream repository, providing full supply-chain transparency.
No typosquatted, attacker-controlled, or suspicious package dependencies are introduced; all references are to well-known Microsoft and Azure tools (Azure CLI, kubectl, AppLens, Azure Monitor).

Low

Content is purely diagnostic and educational; it documents troubleshooting workflows, common error patterns, and safe CLI/kubectl commands for investigating Azure production issues—no instructions to manipulate the AI, exfiltrate data, or bypass security controls.
Guidance consistently emphasizes read-only diagnostics first ('default to read-only diagnostics', 'prefer read-only checks first') and explicitly warns against disruptive operations ('only after explicit user request', 'only with explicit confirmation'); this is defensive design, not malicious instruction.
No prompt injection, system prompt leakage, or guidance poisoning detected; the 'AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE' header is a documentation convention (marking the skill as the official source for AKS troubleshooting within the profile), not an attempt to override the AI's system instructions or hide malicious intent.

Details

Findings

Invisible characters detected
skills/azure-diagnostics/references/azure-resource-graph.md · SKILL-011
Invisible characters detected
skills/azure-diagnostics/references/app-service/README.md · SKILL-011
Invisible characters detected
skills/azure-diagnostics/references/functions/README.md · SKILL-011
Invisible characters detected
skills/azure-diagnostics/troubleshooting/messaging/azure-eventhubs-java.md · SKILL-011
Invisible characters detected
skills/azure-diagnostics/troubleshooting/aks/networking.md · SKILL-011
Invisible characters detected
skills/azure-diagnostics/troubleshooting/aks/node-issues.md · SKILL-011
Invisible characters detected
skills/azure-diagnostics/troubleshooting/aks/pod-failures.md · SKILL-011
Invisible characters detected
skills/azure-diagnostics/troubleshooting/aks/upgrade-operations.md · SKILL-011

Evidence

"default to read-only diagnostics" and "do not restart, delete, cordon, drain, scale, upgrade, or reconfigure resources unless the user explicitly asks for remediation"
"Only use it after the user explicitly approves a mutating test" and "These commands are disruptive. By default, stay in read-only diagnostic mode."

Low

No tool definitions or MCP servers are declared in the profile; the content references existing Azure CLI and kubectl tools by name only, without requesting new permissions or defining custom tools with excessive authority.
Guidance recommends using read-only Azure CLI commands (az aks show, az monitor activity-log list, az graph query) and read-only kubectl operations (get, describe, logs, top) that align with the stated diagnostic purpose.
Disruptive operations (cordon, drain, delete, scale, upgrade) are documented as optional remediation steps only after explicit user approval, not as default or automatic actions.

Details

Evidence

"Prefer Azure-side evidence before Kubernetes-side evidence" and "Use the matching AKS-MCP path first, then the documented CLI fallback if MCP cannot perform that read."
"Keep these read-only unless the user explicitly asks for remediation." (referring to safe fallback checks)
No MCP servers or tool definitions with alwaysApply=true, globs="**", or unrestricted file/shell access.

Low

No MCP servers are defined in the profile; references to mcp_azure_mcp_applens, mcp_azure_mcp_monitor, mcp_azure_mcp_resourcehealth, and mcp_azure_mcp_aks are to known Microsoft Azure diagnostic tools, not arbitrary or hidden binaries.
Tool descriptions are transparent and match their stated purpose (AppLens for AI-powered diagnostics, Monitor for log/metric queries, ResourceHealth for platform status); no hidden instructions or backdoored code templates embedded in tool definitions.
Guidance explicitly directs users to prefer MCP tools over raw CLI when available, but provides safe CLI fallbacks (read-only az aks and kubectl commands) when MCP is unavailable, reducing dependency on external services.

Details

Evidence

"Prefer `mcp_azure_mcp_aks`, then the smallest discovered AKS-MCP tool that fits the read, then supporting Azure tools such as `mcp_azure_mcp_applens`, `mcp_azure_mcp_monitor`, or `mcp_azure_mcp_resourcehealth`. Use raw `az aks` and `kubectl` only when the AKS-MCP surface cannot perform the needed check."
All MCP tool invocations shown are read-only diagnostic calls with explicit parameters (resourceId, command, intent) and no arbitrary code execution or network exfiltration.
No MCP server definitions with unrestricted filesystem, network, or binary execution permissions.