Is azure-deploy safe?

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.

Content hash

sha256:2f999e3d5e20ca0cfb33d9fbcdb67bef4400cab6f3b3aebfa7fc62cfefd180c7

Files

41

Quality

100/100

Security findings

• lowUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/functions-deploy.md:80
  curl -sS -D - -o /dev/null "https://<func-name>.azurewebsites.net/api/<route>"

  The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

• lowDynamic code evaluationSL303 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/post-deployment.md:38
  eval $(azd env get-values)

  The skill builds code at runtime, which hides what actually runs. Fix: Ship the real code as a file in the skill so it can be reviewed and hashed. Severity lowered: the line reads as documentation, not an instruction.

• lowUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/post-deployment.md:79
  curl -f "$ENDPOINT/health" || echo "Health check failed"

  The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

• lowUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/post-deployment.md:82
  curl -f "$ENDPOINT/api/test-db" || echo "Database connection failed"

  The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

• lowDynamic code evaluationSL303 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/sql-managed-identity.md:16
  eval $(azd env get-values)

  The skill builds code at runtime, which hides what actually runs. Fix: Ship the real code as a file in the skill so it can be reviewed and hashed. Severity lowered: the line reads as documentation, not an instruction.

• lowDynamic code evaluationSL303 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/sql-managed-identity.md:83
  eval $(azd env get-values)

  The skill builds code at runtime, which hides what actually runs. Fix: Ship the real code as a file in the skill so it can be reviewed and hashed. Severity lowered: the line reads as documentation, not an instruction.

• lowDynamic code evaluationSL303 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/sql-managed-identity.md:171
  eval $(azd env get-values)

  The skill builds code at runtime, which hides what actually runs. Fix: Ship the real code as a file in the skill so it can be reviewed and hashed. Severity lowered: the line reads as documentation, not an instruction.

• lowUploads data to a remote hostSL203 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/verify.md:26
  curl -f "$ENDPOINT/health" || curl -f "$ENDPOINT"

  The skill sends data to a network endpoint. Fix: Make sure the destination is documented and the user approves each upload. Pin the exact host. Severity lowered: the line reads as documentation, not an instruction.

• lowDynamic code evaluationSL303 · .github/plugins/azure-skills/skills/azure-deploy/references/recipes/azd/verify.md:85
  eval $(azd env get-values)

  The skill builds code at runtime, which hides what actually runs. Fix: Ship the real code as a file in the skill so it can be reviewed and hashed. Severity lowered: the line reads as documentation, not an instruction.

• lowPipes a download into a shellSL301 · .github/plugins/azure-skills/skills/azure-deploy/references/sdk/azd-deployment.md:8
  curl -fsSL https://aka.ms/install-azd.sh | bash

  Remote code is executed without being reviewed or pinned. Whoever controls that URL controls your machine. Fix: Download to a file, verify a checksum, then run it. Or vendor the script into the skill. Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · .github/plugins/azure-skills/skills/azure-deploy/references/sdk/azure-identity-py.md:9
  pip install azure-identity

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.

• infoUnpinned package installSL501 · .github/plugins/azure-skills/skills/azure-deploy/references/sdk/azure-identity-ts.md:8
  npm install @azure/identity

  Installing without a version means a future malicious release lands automatically. Fix: Pin an exact version (pkg==1.2.3, pkg@1.2.3). Severity lowered: the line reads as documentation, not an instruction.