The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (HIGH): The skill documentation includes az vm run-command invoke, a command that allows arbitrary shell scripts to be executed on remote Azure Virtual Machines. If the --scripts argument is populated with untrusted content, it results in full remote system compromise.
[CREDENTIALS_UNSAFE] (HIGH): The skill exposes commands specifically designed to retrieve secrets, such as az storage account keys list and az storage account show-connection-string. An attacker could use these to gain unauthorized access to data stored in Azure.
[COMMAND_EXECUTION] (HIGH): Destructive commands like az group delete and az aks delete include the --yes flag, which bypasses confirmation prompts, increasing the risk of accidental or malicious resource destruction when automated by an agent.
[PROMPT_INJECTION] (HIGH): (Category 8: Indirect Prompt Injection) This skill acts as a high-privilege management interface. It lacks input validation or boundary markers for its command parameters. Because it can execute code and modify cloud infrastructure based on input strings, it is highly susceptible to indirect injection if the agent processes untrusted data (e.g., repository content or external user requests) and passes it to these CLI tools.
[DATA_EXFILTRATION] (MEDIUM): The commands for az storage blob download and az storage blob upload provide a direct path for moving sensitive data from the local environment to external attacker-controlled storage or vice-versa.

azure-cli