heating the forge...

@forgecat/microsoft-azure_skills — Security Risk Report | ForgeCat

microsoft-azure_skills

Security risk report for @forgecat/microsoft-azure_skills v0.0.4

SRC-010High

Static scanner flagged danger level: profile packages upstream microsoft/azure-skills from GitHub (https://github.com/microsoft/azure-skills) — a third-party repository not under ForgeCat's direct control.
Profile is a wrapper/repackaging of external Microsoft-authored code; supply chain risk exists if upstream repository is compromised or contains malicious updates, though Microsoft is a trusted vendor.

Details

Findings

Data exfiltration
skills/entra-agent-id/SKILL.md · SKILL-002
Data exfiltration
skills/azure-deploy/references/recipes/azd/functions-deploy.md · SKILL-002
Data exfiltration
skills/entra-agent-id/references/oauth2-token-flow.md · SKILL-002
Data exfiltration
skills/entra-agent-id/references/obo-blueprint-setup.md · SKILL-002
Suspicious URLs
skills/entra-agent-id/references/sdk-sidecar-deployment.md · SKILL-007
Code obfuscation
skills/microsoft-foundry/finetuning/scripts/calibrate_grader.py · SKILL-005
Credential-to-network dataflow
skills/microsoft-foundry/finetuning/scripts/deploy_model.py · SKILL-010
Credential-to-network dataflow
skills/microsoft-foundry/finetuning/scripts/deploy_model.py · SKILL-010
Credential-to-network dataflow
skills/microsoft-foundry/finetuning/scripts/deploy_model.py · SKILL-010
Credential-to-network dataflow
skills/microsoft-foundry/finetuning/scripts/deploy_model.py · SKILL-010
Credential-to-network dataflow
skills/microsoft-foundry/finetuning/scripts/deploy_model.py · SKILL-010
Data exfiltration
skills/microsoft-foundry/finetuning/scripts/submit_training.py · SKILL-002

Low

Content is educational and reference material: skill guides walk users through legitimate Azure operations (AKS setup, model deployment, telemetry instrumentation) with clear prerequisites and error handling.
No instructions to ignore system prompts, exfiltrate credentials, read sensitive files, or install remote payloads; all commands are standard Azure CLI/kubectl operations.
Guidance on authentication (auth-best-practices.md) actively recommends security best practices (managed identities, least-privilege RBAC, no hardcoded secrets) — not poisoning.

Details

Findings

Invisible characters detected
skills/azure-hosted-copilot-sdk/SKILL.md · SKILL-011
Invisible characters detected
skills/azure-prepare/SKILL.md · SKILL-011
Invisible characters detected
skills/azure-quotas/SKILL.md · SKILL-011
Invisible characters detected
skills/azure-reliability/SKILL.md · SKILL-011
Invisible characters detected
skills/azure-resource-lookup/SKILL.md · SKILL-011

PRM-003Medium

The telemetry hook `hooks/scripts/track-telemetry.sh` is flagged as having no matching tool declaration, meaning a shell script runs as a post-tool hook without a corresponding declared tool scope — this is an unscoped shell execution.
The MCP server uses `npx -y @azure/mcp@latest server start` which auto-accepts and executes the latest published npm package without version pinning, granting broad network and Azure resource access at runtime.
The declared skills themselves are read/guidance-oriented, but the combination of an unreviewed shell hook and a latest-version MCP server represents authority somewhat broader than a pure documentation/guidance profile warrants.

Details

Findings

Evidence

README.md: 'Post-tool telemetry hook from hooks/scripts/track-telemetry.sh'
.mcp.json: `"args": ["-y", "@azure/mcp@latest", "server", "start"]` — `-y` auto-confirms, `@latest` unpinned
Static hint: `[permissions/hook-no-tool-match] ./hooks/scripts/track-telemetry.sh`

MCP-000Medium

The MCP server runs `npx -y @azure/mcp@latest` — `@latest` is unpinned, meaning any future compromise or malicious publish of the `@azure/mcp` package would be automatically executed.
The `@azure/mcp` package is a known Microsoft-published package providing broad Azure resource management capabilities (search, speech, storage, etc.), which is a wide but legitimate scope for this profile's stated purpose.
No hidden instructions were found in the MCP server definition itself, and the server name/command matches the profile's declared Azure integration purpose.

Details

Evidence

.mcp.json: `"command": "npx", "args": ["-y", "@azure/mcp@latest", "server", "start"]`
README.md: 'The MCP server runs with npx -y @azure/mcp@latest server start'
skills/azure-ai/SKILL.md: lists `azure__search`, `azure__speech` as MCP tools — consistent with declared purpose