heating the forge...

@forgecat/microsoft-azure_skills-microsoft-foundry — Security Risk Report | ForgeCat

microsoft-azure_skills-microsoft-foundry

Security risk report for @forgecat/microsoft-azure_skills-microsoft-foundry v0.0.4

Low

Static scanner flagged safe level; profile is sourced from Microsoft's official Foundry samples and agent-framework repositories.
Content references legitimate Microsoft GitHub repos (microsoft-foundry/foundry-samples, microsoft/agent-framework) and official MS Learn documentation.
No typosquatted, attacker-controlled, or suspicious package/repository references detected.

Low

Profile is a legitimate skill documentation set for Azure Foundry agent deployment; no instructions to ignore system prompts, read credentials, exfiltrate data, or install malicious payloads.
Content describes standard Azure/Foundry workflows (create agents, deploy models, evaluate, troubleshoot) with references to official Microsoft tools and documentation.
Mandatory pre-execution checks (e.g., 'call foundry tool first', 'read sub-skill before executing') are defensive guardrails, not manipulation attempts.

Details

Findings

Invisible characters detected
skills/microsoft-foundry/rbac/rbac.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/references/standard-agent-setup.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/quota/quota.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/create/create-prompt.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/create/create.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/deploy/deploy.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/eval-datasets/eval-datasets.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/trace/trace.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/observe/observe.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/troubleshoot/troubleshoot.md · SKILL-011
Invisible characters detected
skills/microsoft-foundry/foundry-agent/create/references/agent-tools.md · SKILL-011

PRM-000Medium

The skill orchestrates Docker builds, ACR pushes, container starts, file downloads, shell command execution (az CLI, gh CLI, curl, pip, venv), and file writes as part of its stated workflows — these are high-authority operations, though they are consistent with a DevOps/deployment skill's stated purpose.
No declared tool categories were provided (none declared), so the authority is exercised through prose instructions to the agent rather than explicit tool grants, making scope harder to audit.
The breadth of operations (RBAC assignment, quota management, network isolation deployment, model deployment, dataset management) is wide but matches the explicitly stated scope of an end-to-end Foundry agent lifecycle skill.

Details

Evidence

"Docker build, ACR push, hosted/prompt agent create, container start" (description)
"RBAC, role assignment, permissions, quota, capacity, region" (description)
Shell commands in create.md: `gh api ...`, `curl -sL "$url" -o "$filepath"`, `pip install`, venv activation

MCP-000Medium

Profile references MCP server integration but does not define specific MCP servers; tool-mcp.md documents safe patterns (approval workflows, allowed_tools restrictions, connection-based auth).
MCP server endpoints are user-supplied (not hardcoded); profile instructs validation: 'Always use require_approval="always" unless you fully trust the MCP server'.
Known limitations documented (100-second timeout, identity passthrough restrictions, network isolation constraints) indicate security-aware design.

Details

Evidence

tool-mcp.md: 'Best practice: Always use require_approval="always" unless you fully trust the MCP server. Use allowed_tools to restrict which tools the agent can access.'
No hidden instructions in tool descriptions; MCP tool parameters are explicit (server_label, server_url, require_approval, allowed_tools, project_connection_id).
Known Limitations section documents security constraints: '100-second timeout for non-streaming MCP tool calls', 'Network-secured Foundry can't use private MCP servers in same vNET'.