Security risk report for @forgecat/microsoft-azure_skills-azure-resource-lookup v0.0.5
Source Integrity
Low
Profile is attributed to Microsoft and references the official Azure Skills repository (https://github.com/microsoft/azure-skills).
Metadata includes version, commit hash, and MIT license — consistent with a legitimate open-source project.
Agent Intent
Low
Content describes legitimate Azure Resource Graph query patterns and MCP tool workflows; no instructions to ignore system prompts, exfiltrate credentials, or perform unauthorized actions.
Documentation is educational and prescriptive for a single, well-scoped function (resource discovery); no guidance poisoning or malicious knowledge injection.
"Never use ARG for real-time monitoring (data has slight delay)"
All KQL patterns are read-only queries (summarize, where, project, join)
Permissions
Low
No explicit tool declarations in the profile; references to `extension_cli_generate`, `mcp_azure_mcp_subscription_list`, and `mcp_azure_mcp_group_list` are documented as read-only query helpers.
Authority is narrowly scoped to Azure Resource Graph queries and subscription/resource group enumeration — aligned with the stated purpose of resource discovery.
No file write, deletion, shell execution, or mutation capabilities are requested or implied.
ForgeCat