azure-quotas
Warn
Audited by Socket on Sep 14, 2026
1 alert found:
SecuritySecurityscripts/check-quota.sh
MEDIUMSecurityMEDIUM
scripts/check-quota.sh
The code is a legitimate Azure quota-reporting script with no clear malicious intent, but it contains a significant code-injection weakness in all-quotas mode. Azure JSON and the region argument are embedded directly into generated Python source. Use `python3` with JSON supplied via stdin or environment-safe mechanisms, and validate numeric quota values and region format before processing. The automatic quota-extension installation is expected behavior but should be reviewed under the deployment's trust policy.
Confidence: 96%Severity: 72%
Audit Metadata