The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Hardcoded passwords are provided in example commands, which may be executed literally by the agent.
File: SKILL.md
Evidence: --admin-password "Password123!" is used in both az sql server create and az postgres flexible-server create commands.
[COMMAND_EXECUTION]: The skill includes instructions to create insecure network configurations that permit global access.
File: SKILL.md
Evidence: az postgres flexible-server firewall-rule create configured with --start-ip-address 0.0.0.0 --end-ip-address 255.255.255.255, effectively disabling firewall protections for the database.
[COMMAND_EXECUTION]: Extensive capability to retrieve sensitive cleartext credentials and secrets from cloud resources.
File: SKILL.md
Evidence: Includes commands such as az storage account show-connection-string, az keyvault secret show, and az servicebus namespace authorization-rule keys list which expose authentication tokens and secrets directly to the agent's context.
[EXTERNAL_DOWNLOADS]: Fetches source code from external repositories for deployment tasks.
File: SKILL.md
Evidence: az webapp deployment source config utilizes external URLs like https://github.com/org/repo. Note that github.com is a well-known service.
[PROMPT_INJECTION]: Potential for indirect prompt injection via ingestion of untrusted application logs and query results.
Ingestion points: az webapp log tail and az monitor log-analytics query in SKILL.md allow external data into the agent's prompt.
Boundary markers: None present to distinguish between logs and system instructions.
Capability inventory: Full resource management, including RBAC assignment and secret retrieval capabilities.
Sanitization: No sanitization or filtering of log content is specified.

azure-mcp