heating the forge...

@forgecat/microsoft-azure_skills-azure-validate — Security Risk Report | ForgeCat

microsoft-azure_skills-azure-validate

Security risk report for @forgecat/microsoft-azure_skills-azure-validate v0.0.4

Low

Static scanner flagged safe level: profile declares Microsoft as author with reference to official https://github.com/microsoft/azure-skills repository.
Content is consistent with legitimate Azure validation tooling (azure.yaml schema, Bicep/Terraform validation, AZD CLI commands, Azure Policy checks).
No evidence of typosquatted packages, attacker-controlled dependencies, or supply-chain poisoning; all referenced tools are standard Microsoft/HashiCorp products.

Low

Profile documents pre-deployment validation workflows (schema checks, template validation, policy compliance, RBAC verification) — standard DevOps practices, not manipulation.
Content instructs the agent to run legitimate Azure CLI/AZD commands (az bicep build, azd provision --preview, terraform validate) and record results; no instructions to ignore system prompts, read credentials, or exfiltrate data.
Guidance on role verification, policy compliance, and error handling is security-strengthening, not weakening; e.g., 'Do NOT set status to Validated without running checks and recording proof' enforces rigor.

Details

Findings

Invisible characters detected
skills/azure-validate/SKILL.md · SKILL-011
Invisible characters detected
skills/azure-validate/references/aspire-functions-secrets.md · SKILL-011
Invisible characters detected
skills/azure-validate/references/region-availability.md · SKILL-011
Invisible characters detected
skills/azure-validate/references/role-verification.md · SKILL-011
Invisible characters detected
skills/azure-validate/references/recipes/azd/README.md · SKILL-011
Invisible characters detected
skills/azure-validate/references/recipes/azd/aspire.md · SKILL-011
Invisible characters detected
skills/azure-validate/references/recipes/terraform/README.md · SKILL-011
Invisible characters detected
skills/azure-validate/references/recipes/terraform/errors.md · SKILL-011

Evidence

SKILL.md: 'Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.)' — instructing legitimate validation, not injection.
global-rules.md: 'ALWAYS use ask_user before ANY destructive action' — enforces user confirmation, not bypassing it.
role-verification.md: 'Roles scoped to specific resources, not resource groups or subscriptions' — guidance on least-privilege RBAC, not weakening security.

Low

Profile declares no tool definitions or MCP servers; it is pure markdown guidance for an AI agent to invoke existing Azure CLI/AZD tools.
Guidance instructs the agent to prompt the user (ask_user) before destructive actions (delete, overwrite, provision expensive resources); authority is conditional and user-gated.
Scope matches stated function: validation-only operations (read config, run preview/validate commands, check policies, verify roles) — no file deletion, secret exfiltration, or unrestricted shell access.

Details

Evidence

global-rules.md: 'ALWAYS use ask_user before ANY destructive action' with examples (az group delete, azd down, rm -rf).
SKILL.md: 'Destructive actions require ask_user' — enforces user confirmation gate.
No declared shell_exec, file_delete, or file_mutate tools; guidance is read-only validation.

Low

Profile declares no MCP servers; it is pure markdown guidance referencing standard Azure CLI and AZD tools.
References to 'mcp_azure_mcp_*' tools (e.g., mcp_azure_mcp_policy, mcp_azure_mcp_subscription_list) are documented as legitimate Azure MCP integrations for querying subscriptions, policies, and quotas — not arbitrary code execution.
No hidden instructions in tool descriptions; all guidance is explicit and transparent about what commands to run and why.

Details

Evidence

policy-validation.md: 'mcp_azure_mcp_policy(command: "list", parameters: { subscription_id: "<subscription-id>" })' — documented MCP call for policy retrieval, not hidden.
azd/README.md: 'mcp_azure_mcp_azd(command: "validate_azure_yaml", ...)' — explicit MCP invocation for schema validation.
No binary execution, unrestricted filesystem, or network access declared.