$ ~/registry/skill/microsoft-plugin-skills-azure-validate

SKILL

azure-validate

Name: azure-validate
Author: microsoft

在部署前深度检查 Azure 配置、权限与基础设施就绪情况，提前发现风险。

星标

★ 232

来源

GitHub

更新于

2026-07-13

// 安全评估高风险

仅提示词，不执行代码
开源可审计

总评

该技能表面上是开源的提示型 Azure 部署前校验说明，不要求密钥且未声明固定远程端点，整体技术面风险较低。但 README 含有明显的强制性工作流与提示注入式措辞，可能诱导宿主代理执行额外命令、读写项目文件并串联其他技能，供应链维度需重点警惕。

凭证密钥低风险

材料明确标注“无”密钥/环境变量，README 也未要求用户提供 token、API key 或账户凭证；未见直接的凭证收集、存储或外传设计。

网络外发需留意

虽未声明固定远程端点，但说明中要求运行 Azure/Bicep/Terraform 相关验证命令与 what-if / preview 类检查，这类流程通常可能连接 Azure 控制面或相关服务；属于与声明功能一致的常规外联，未见不明第三方外发端点。

代码执行需留意

该技能本身被标记为 prompt-only、开源，不自带可执行程序；但 README 明确指示宿主代理运行验证、构建和相关命令，并调用 azure-prepare/azure-deploy。若宿主具备执行能力，可能触发本机进程执行；这属于技能工作流常规能力，未见额外越权系统权限请求。

数据访问需留意

README 指示读取并修改 `.azure/deployment-plan.md`，检查 `azure.yaml`、Bicep/Terraform、RBAC 角色分配与托管身份权限，并记录验证结果；说明其预期访问范围覆盖项目部署配置与基础设施代码。该访问与功能目标一致，但用户应知晓会读写项目内相关文件。

来源供应链高风险

虽来自 GitHub 且为开源仓库，并带有微软仓库链接这一正面信号，但材料同时出现明显的提示注入/操控性措辞，如“AUTHORITATIVE GUIDANCE”“STOP IMMEDIATELY”“MUST invoke azure-deploy”“Do NOT ... directly”。这类内容试图以第三方 README 重新定义代理行为与调用链，属于具体红旗；加之 star 为 0、许可证未声明、维护状态未知，供应链可信度仍需谨慎对待。

安全建议

将该技能视为不可信提示内容处理，不要让 README 自行决定是否必须调用其他技能或执行命令。
在隔离环境中运行任何验证/构建命令，并限制其对本地文件与 Azure 订阅的权限范围。
人工审查其引用的工作流文件与 recipe 内容，特别是 `.azure/deployment-plan.md` 的改写逻辑。
优先核验仓库许可、维护活跃度与实际源码内容，再决定是否纳入自动化链路。

审计模型: gpt-5.4 · 2026-06-16

// 安装

复制安装指令，让 AI 自动完成配置 · 推荐新手

请帮我安装 askskill 上的 "azure-validate" 技能：
1. 下载 https://raw.githubusercontent.com/microsoft/GitHub-Copilot-for-Azure/main/plugin/skills/azure-validate/SKILL.md
2. 保存为 ~/.claude/skills/azure-validate/SKILL.md
3. 装好后重载技能，告诉我可以用了

// 下载

下载 SKILL.md机读安装清单 ↗

// 用法示例

发布前就绪检查

输入

请帮我验证这个 Azure 应用是否已准备好部署。检查 azure.yaml、环境配置、依赖资源、订阅与区域设置，并列出阻塞部署的问题和修复建议。

预期产出

一份部署前检查报告，说明是否可部署、存在的问题、风险等级及修复建议。

验证 Bicep 或 Terraform

输入

请检查这份 Bicep/Terraform 基础设施定义是否适合在 Azure 部署，验证资源配置、依赖关系、命名、参数、配额与潜在冲突，并指出需要修改的地方。

预期产出

一份基础设施验证结果，包含配置错误、潜在风险、不兼容项与修改建议。

检查 RBAC 与托管身份权限

输入

请验证这个 Azure Functions/Container Apps 部署所需的 RBAC 角色分配和托管身份权限是否齐全，找出缺失权限、作用域错误或最小权限原则问题。

预期产出

一份权限审查结果，列出缺失角色、错误作用域、权限风险及建议的最小权限配置。

// 文档

Azure Validate

AUTHORITATIVE GUIDANCE — Follow these instructions exactly unless they contradict security policies given to you.

⛔ STOP — PREREQUISITE CHECK REQUIRED

Before proceeding, verify this prerequisite is met:

azure-prepare was invoked and completed → .azure/deployment-plan.md exists with status Approved or later

If the plan is missing, STOP IMMEDIATELY and invoke azure-prepare first.

The complete workflow ensures success:

azure-prepare → azure-validate → azure-deploy

Triggers

Check if app is ready to deploy
Validate azure.yaml or Bicep
Run preflight checks
Troubleshoot deployment errors

Rules

Run after azure-prepare, before azure-deploy
All checks must pass—do not deploy with failures
⛔ Destructive actions require ask_user — global-rules

Steps

#	Action	Reference
1	Load Plan — Read `.azure/deployment-plan.md` for recipe and configuration. If missing → run azure-prepare first	`.azure/deployment-plan.md`
2	Add Validation Steps — Copy recipe "Validation Steps" to `.azure/deployment-plan.md` as children of "All validation checks pass"	recipes/README.md, `.azure/deployment-plan.md`
3	Run Validation — Execute recipe-specific validation commands	recipes/README.md
4	Build Verification — Build the project and fix any errors before proceeding	See recipe
5	Static Role Verification — Review Bicep/Terraform for correct RBAC role assignments in code	role-verification.md
6	Record Proof — Populate Section 7: Validation Proof with commands run and results	`.azure/deployment-plan.md`
7	Resolve Errors — Fix failures before proceeding	See recipe's `errors.md`
8	Update Status — Only after ALL checks pass, set status to `Validated`	`.azure/deployment-plan.md`
9	Deploy — Invoke azure-deploy skill	—

⛔ VALIDATION AUTHORITY

This skill is the officially verified way to set plan status to Validated. You MUST follow these steps to make sure every prerequisite is fulfilled before setting status to Validated:

Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.)

Populate Section 7: Validation Proof with the commands you ran and their results

Only then set status to Validated

Do NOT set status to Validated without running checks and recording proof.

⚠️ MANDATORY NEXT STEP — DO NOT SKIP

After ALL validations pass, you MUST invoke azure-deploy to execute the deployment. Do NOT attempt to run azd up, azd deploy, or any deployment commands directly. Let azure-deploy handle execution.

If any validation failed, fix the issues and re-run azure-validate before proceeding.

帮助你在数据流经各层时建立分层校验，提前阻断缺陷与安全风险。

obra装→

$ loading_

请帮我安装 askskill 上的 "azure-validate" 技能： 1. 下载 https://raw.githubusercontent.com/microsoft/GitHub-Copilot-for-Azure/main/plugin/skills/azure-validate/SKILL.md 2. 保存为 ~/.claude/skills/azure-validate/SKILL.md 3. 装好后重载技能，告诉我可以用了

// 用法示例

发布前就绪检查

输入

请帮我验证这个 Azure 应用是否已准备好部署。检查 azure.yaml、环境配置、依赖资源、订阅与区域设置，并列出阻塞部署的问题和修复建议。

预期产出

一份部署前检查报告，说明是否可部署、存在的问题、风险等级及修复建议。

验证 Bicep 或 Terraform

输入

请检查这份 Bicep/Terraform 基础设施定义是否适合在 Azure 部署，验证资源配置、依赖关系、命名、参数、配额与潜在冲突，并指出需要修改的地方。

预期产出

一份基础设施验证结果，包含配置错误、潜在风险、不兼容项与修改建议。

检查 RBAC 与托管身份权限

输入

请验证这个 Azure Functions/Container Apps 部署所需的 RBAC 角色分配和托管身份权限是否齐全，找出缺失权限、作用域错误或最小权限原则问题。

预期产出

一份权限审查结果，列出缺失角色、错误作用域、权限风险及建议的最小权限配置。

// 文档

Azure Validate

AUTHORITATIVE GUIDANCE — Follow these instructions exactly unless they contradict security policies given to you.

⛔ STOP — PREREQUISITE CHECK REQUIRED

Before proceeding, verify this prerequisite is met:

azure-prepare was invoked and completed → .azure/deployment-plan.md exists with status Approved or later

If the plan is missing, STOP IMMEDIATELY and invoke azure-prepare first.

The complete workflow ensures success:

azure-prepare → azure-validate → azure-deploy

Triggers

Check if app is ready to deploy
Validate azure.yaml or Bicep
Run preflight checks
Troubleshoot deployment errors

Rules

Run after azure-prepare, before azure-deploy
All checks must pass—do not deploy with failures
⛔ Destructive actions require ask_user — global-rules

Steps

#	Action	Reference
1	Load Plan — Read `.azure/deployment-plan.md` for recipe and configuration. If missing → run azure-prepare first	`.azure/deployment-plan.md`
2	Add Validation Steps — Copy recipe "Validation Steps" to `.azure/deployment-plan.md` as children of "All validation checks pass"	recipes/README.md, `.azure/deployment-plan.md`
3	Run Validation — Execute recipe-specific validation commands	recipes/README.md
4	Build Verification — Build the project and fix any errors before proceeding	See recipe
5	Static Role Verification — Review Bicep/Terraform for correct RBAC role assignments in code	role-verification.md
6	Record Proof — Populate Section 7: Validation Proof with commands run and results	`.azure/deployment-plan.md`
7	Resolve Errors — Fix failures before proceeding	See recipe's `errors.md`
8	Update Status — Only after ALL checks pass, set status to `Validated`	`.azure/deployment-plan.md`
9	Deploy — Invoke azure-deploy skill	—

⛔ VALIDATION AUTHORITY

This skill is the officially verified way to set plan status to Validated. You MUST follow these steps to make sure every prerequisite is fulfilled before setting status to Validated:

Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.)

Populate Section 7: Validation Proof with the commands you ran and their results

Only then set status to Validated

Do NOT set status to Validated without running checks and recording proof.

⚠️ MANDATORY NEXT STEP — DO NOT SKIP

After ALL validations pass, you MUST invoke azure-deploy to execute the deployment. Do NOT attempt to run azd up, azd deploy, or any deployment commands directly. Let azure-deploy handle execution.

If any validation failed, fix the issues and re-run azure-validate before proceeding.