Cloudflare security-audit
cloudflare/security-audit-skillA single multi-agent skill from Cloudflare that audits a codebase in six phases and writes validated, independently verified findings.
Recommended
Check first Depth 5/5
Azure Compliance (Azure Skills) skill
Microsoft skill that runs azqr compliance scans and Key Vault expiration checks, then sorts findings by priority with remediation steps.
Our verdict Recommended
A focused, read-only audit workflow from Microsoft that adds a real tool (azqr) and an expiry audit; scope is narrow but clear.
What the azure-compliance skill does
azure-compliance has the agent run an Azure compliance and security audit and summarize it. The workflow is five steps: choose a scope (subscription, resource group, management group or one service), run azqr (Azure Quick Review) through the Azure MCP extension, read the resulting Excel report (recommendations and impacted-resource sheets), check Key Vault keys, secrets and certificates for expired or soon-to-expire items, and then classify each finding as Critical, High, Medium or Low with a fix. Prerequisites are an az login and Reader permissions. The SKILL.md is about 4 KB with a short error table (authentication, forbidden, not found) and best practices such as scanning weekly or monthly and keeping reporting separate from remediation. Reference files cover azqr usage and recommendation patterns, an expiration-audit procedure, Azure Resource Graph queries, and nine condensed Key Vault SDK guides in Python, TypeScript, Java, .NET and Rust. The skill reads configuration and Key Vault metadata; it does not apply fixes itself.
Good for
- Periodic Azure posture reviews with azqr
- Finding expired or expiring Key Vault secrets, keys and certificates
- Turning a raw azqr report into a prioritized remediation list
Not for
- Compliance frameworks beyond what azqr checks (no policy mapping to SOC 2 or ISO in the files)
- Automatic remediation
Depth 3/5
4 KB SKILL.md plus 15 reference files (azqr guides, expiration audit, Resource Graph, SDK notes), no scripts or evals.
Dependencies and costs
- Azure account or subscription
- Azure CLI signed in with az login
- Azure MCP Server (installed with the plugin; needs Node.js 18+ for npx)
- Reader role on the target scope
- azqr via the Azure MCP extension
- Key Vault read permission for metadata
- Telemetry: The skill files contain no telemetry code. The Azure MCP Server that the plugin wires in has its own telemetry; the repo README says to disable it with AZURE_MCP_COLLECT_TELEMETRY=false.
Security review
Review before installingDocumentation-only skill (16 files) for Azure compliance and security audits with azqr and Key Vault expiration checks. It can list Key Vault secrets and read their metadata through MCP tools, and its remediation docs show az commands that change resources.
Worth knowing
- Relies on a CLI or package we could not reviewRuns azqr and Key Vault inspection through Azure MCP tools; remediation docs use az..github/plugins/azure-skills/skills/azure-compliance/SKILL.md:18
- Installs packages or toolsTells you to run 'az extension add --name resource-graph'; SDK docs include pip and npm installs for Key Vault clients..github/plugins/azure-skills/skills/azure-compliance/references/azure-resource-graph.md:21
What we checked
The skill folder (16 files) on Oct 29, 2026. Not a full review: it relies on code outside the repository: Azure CLI (az) and the az extensions it installs on demand; not part of the files we have; Azure MCP Server, started by the plugin through npx; its configuration sits outside this skill folder; azqr (provided through the Azure MCP extension).
NVIDIA SkillSpector static scan: 0 pattern hits. No SkillSpector hits. Credential matches are Key Vault tool names (keyvault_secret_list, keyvault_secret_get) and passwordless-auth guidance.
A review, not a certification. Skills change after we check them — read the files before installing.
License
MIT (declared in the SKILL.md frontmatter); the repo is a mirror synced from microsoft/GitHub-Copilot-for-Azure and has no top-level LICENSE file in our copy. Commercial use allowed under MIT.
Can it run unattended?
Not really. The workflow is a single interactive assessment; it could be repeated on a schedule but has no loop or state handling of its own.
Alternatives
Trail of Bits Skills
trailofbits/skillsTrail of Bits' marketplace of 97 security skills: smart-contract scanners, C/C++ and Rust review, Semgrep and CodeQL workflows, variant analysis and audit helpers.
Recommended
Broad access Depth 4/5
Google Agent Skills
google/skillsGoogle's official collection of about 180 skills for Google Cloud, Gemini APIs, Analytics, Data Manager, sign-in and other Google products.
Recommended
Broad access Depth 3/5
FAQ
What does azure-compliance do?
It runs an azqr (Azure Quick Review) assessment through the Azure MCP extension, audits Key Vault keys, secrets and certificates for expiration, and classifies the findings by priority with remediation suggestions.
Does azure-compliance fix issues automatically?
No. Its best-practice list says to separate compliance reporting from remediation, and the workflow ends with proposed fixes for each finding.
What permissions does azure-compliance need?
The skill lists an az login and permission to read resource configuration and Key Vault metadata; Reader on the scope is the stated minimum for azqr.
How do I install azure-compliance?
Install Microsoft's Azure plugin: /plugin install azure@claude-plugins-official in Claude Code, or add microsoft/azure-skills as a Codex marketplace, then sign in with az login.
Sources: GitHub repository; install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the published SKILL.md.