Search skills/

Azure Diagnostics (Azure Skills) skill

Microsoft's troubleshooting skill for App Service, Container Apps, Functions, AKS, VMs and Event Hubs/Service Bus, with bundled diagnostic scripts.

in microsoft/azure-skills Planning, TDD & debuggingCloud & DevOps
Our verdict Recommended

The most substantial troubleshooting skill in the Azure pack, with real scripts and an explicit evidence-only mode.

4/5 Depth expertise shipped Note Security Review before installing 0d Maintenance Updated today 573K Adoption installs OK License MIT, commercial OK

What the azure-diagnostics skill does

azure-diagnostics gives an agent a structured way to debug Azure production problems. SKILL.md sets a flow (identify symptoms, check resource health, review logs, analyze metrics, look at recent changes) and routes to service-specific guides: Container Apps (image pull failures, cold starts, probes, port mismatches), App Service (high CPU, failed deploys, TLS and custom domains), Functions (invocations, timeouts, bindings, missing telemetry), AKS, VM connectivity over RDP or SSH, and Event Hubs and Service Bus SDK errors. The folder has about 54 files, among them KQL and Resource Graph query references and twelve shell and PowerShell scripts: app service and container app diagnostics, an AKS baseline collector, pod evidence gathering, messaging connectivity tests, and run-ig, which assembles Inspektor Gadget traces through kubectl debug. The rules tell the agent to use supplied evidence first, to skip live access if the user prohibits it, and to prefer the bundled scripts for permitted live collection. AKS content points to an optional separate aks-skills add-on.

Good for

  • Triage of a failing App Service, Container App, Function App or AKS workload
  • Evidence-only analysis of logs you paste in without giving the agent live Azure access
  • Messaging SDK problems such as lost message locks or AMQP link errors

Not for

  • Cost analysis or capacity planning
  • Making infrastructure changes (it is diagnosis-first)

Depth 4/5

7.5 KB SKILL.md plus about 54 files: service-specific troubleshooting trees, KQL references and 12 bash and PowerShell collection scripts; no evals.

Dependencies and costs

  • Azure account or subscription
  • Azure CLI signed in with az login
  • Azure MCP Server (installed with the plugin; needs Node.js 18+ for npx)
  • kubectl for the AKS scripts
  • Read access to the affected resources, Log Analytics or App Insights
  • Telemetry: The skill files contain no telemetry code. The Azure MCP Server that the plugin wires in has its own telemetry; the repo README says to disable it with AZURE_MCP_COLLECT_TELEMETRY=false.

Security review

Review before installing

Troubleshooting skill for App Service, Container Apps, AKS, Functions and messaging with helper scripts that mostly read state through az and kubectl. One script opens a privileged node debug session to run Inspektor Gadget, and another probes a Service Bus or Event Hubs endpoint over the network.

Worth knowing

  • Relies on a CLI or package we could not reviewrun-ig.sh starts 'kubectl debug --profile=sysadmin' on an AKS node with the pinned Inspektor Gadget image; other scripts need az and kubectl..github/plugins/azure-skills/skills/azure-diagnostics/scripts/run-ig.sh:124
  • Makes network requestsResolves DNS, probes TCP ports and curls https://<namespace>.servicebus.windows.net/ for a namespace you name..github/plugins/azure-skills/skills/azure-diagnostics/scripts/test-messaging-connectivity.sh:146

What we checked

The skill folder (54 files) on Oct 29, 2026. Not a full review: we read 6 of 12 code files; it relies on code outside the repository: Azure CLI (az) and the az extensions it installs on demand; not part of the files we have; kubectl and the Inspektor Gadget image mcr.microsoft.com/oss/v2/inspektor-gadget/ig run on a node; Azure MCP Server, started by the plugin through npx; its configuration sits outside this skill folder.

NVIDIA SkillSpector static scan: 6 pattern hits (Privilege Escalation 2, YARA Match 1, Tool Misuse 1, MCP Least Privilege 1, Excessive Agency 1). A YARA 'backdoor_persistence' match on references/functions/triggers.md is the phrase 'root cause' in a table. The kubeconfig and sudo hits are troubleshooting prose. Scripts only read state, except run-ig.sh which opens a privileged node debug session.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT (declared in the SKILL.md frontmatter); the repo is a mirror synced from microsoft/GitHub-Copilot-for-Azure and has no top-level LICENSE file in our copy. Commercial use allowed under MIT.

Can it run unattended?

Not really. Diagnosis is interactive and some steps (privileged debug pods) need explicit user approval.

Alternatives

Google Agent Skills

google/skills

Google's official collection of about 180 skills for Google Cloud, Gemini APIs, Analytics, Data Manager, sign-in and other Google products.

Recommended Broad access Depth 3/5

Cloudflare Skills

cloudflare/skills

Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.

Recommended Check first Depth 4/5

Chrome DevTools MCP

ChromeDevTools/chrome-devtools-mcp

Google's Chrome DevTools MCP server and CLI, plus seven skills for debugging performance, memory leaks, cookies and accessibility in a live Chrome.

With caveats Check first Depth 3/5

FAQ

What is the azure-diagnostics skill?

A skill from Microsoft's Azure plugin that guides an agent through debugging production issues on App Service, Container Apps, Functions, AKS, VMs and messaging SDKs, using AppLens, Azure Monitor, resource health and bundled scripts.

Can azure-diagnostics work without access to my Azure account?

Yes. Rule 2 says that if you ask for evidence-only analysis or forbid live access, the agent must not query Azure and should diagnose from the logs, metrics and timeline you supply.

Is azure-diagnostics safe to run?

Mostly read-only collection. The one risky piece is run-ig, which starts a privileged kubectl debug pod for Inspektor Gadget traces; the script says it requires explicit approval and offers a dry-run mode.

How do I install azure-diagnostics?

Install Microsoft's Azure plugin (/plugin install azure@claude-plugins-official in Claude Code, or the Codex plugin marketplace for microsoft/azure-skills) and sign in with az login.

Sources: GitHub repository; install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the published SKILL.md.