Cloudflare security-audit
cloudflare/security-audit-skillA single multi-agent skill from Cloudflare that audits a codebase in six phases and writes validated, independently verified findings.
Recommended
Check first Depth 5/5
Azure Validate (Azure Skills) skill
Microsoft's pre-deployment check: a scripted workflow that validates azure.yaml, Bicep or Terraform, RBAC and prerequisites before azure-deploy.
Our verdict Recommended
A concrete, script-driven preflight that makes the deploy chain safer; it only pays off if you use the prepare-validate-deploy trio.
What the azure-validate skill does
azure-validate sits between azure-prepare and azure-deploy. It will not run unless a deployment plan exists with status Approved or later. Instead of listing checks in prose, its SKILL.md tells the agent to run a workflow script (workflow.sh or workflow.ps1) repeatedly: each run prints the next action and the value to pass back, and progress is recorded in .azure/validate-status.json until the script reports completion. The recipes behind it cover azd and Azure CLI environment checks, Bicep and Terraform validation (validate-terraform scripts, what-if analysis), policy validation, role-assignment and managed-identity verification, and a scan for secrets in Aspire and Functions setups. About 27 files, ten of them shell or PowerShell scripts. Only this skill is allowed to set the plan status to Validated, and the validation proof is stored for azure-deploy to check. If the user asked only to validate, it stops there; if they asked to deploy, it hands off to azure-deploy.
Good for
- A preflight check before azd up, terraform apply or az deployment
- Verifying RBAC roles and managed-identity permissions before they cause a failed deploy
- Teams that want recorded validation proof in the repo
Not for
- Projects without an azure-prepare deployment plan
- General code review or non-Azure validation
Depth 4/5
A short 3.5 KB SKILL.md backed by 27 files, including ten validation scripts, recipes per tool and a state file; no evals.
Dependencies and costs
- Azure account or subscription
- Azure CLI signed in with az login
- Azure MCP Server (installed with the plugin; needs Node.js 18+ for npx)
- Azure Developer CLI (azd)
- PowerShell (pwsh) or bash for the workflow scripts
- Terraform CLI for Terraform projects
- Telemetry: The skill files contain no telemetry code. The Azure MCP Server that the plugin wires in has its own telemetry; the repo README says to disable it with AZURE_MCP_COLLECT_TELEMETRY=false.
Security review
Review before installingPre-deployment validation skill that runs Bicep and Terraform checks, az deployment what-if and a Terraform plan, and records results in .azure/validate-status.json in your project. The scripts are read-only apart from azd environment values set by set-aspire-aca-env.sh.
Worth knowing
- Relies on a CLI or package we could not reviewRuns 'az bicep build', 'az deployment validate' and 'az deployment what-if', and terraform init, validate and plan, against your subscription..github/plugins/azure-skills/skills/azure-validate/references/recipes/scripts/validate-deployment.sh:1
- Installs packages or tools'terraform init' downloads the providers your configuration declares..github/plugins/azure-skills/skills/azure-validate/references/recipes/terraform/scripts/validate-terraform.sh:106
What we checked
The skill folder (27 files) on Oct 29, 2026. Not a full review: we read 5 of 10 code files; it relies on code outside the repository: Azure CLI (az) and the az extensions it installs on demand; not part of the files we have; terraform and Azure Developer CLI (azd); Azure MCP Server, started by the plugin through npx; its configuration sits outside this skill folder.
NVIDIA SkillSpector static scan: 22 pattern hits (Privilege Escalation 19, analysis-evasion 2, Rogue Agent 1). Hits are documentation: '.azure/' paths, a 'Replace existing file' rule and a partial-analysis note for workflow.sh, which I read in full. None of the scripts deploy or delete anything; they run validate, what-if and plan.
A review, not a certification. Skills change after we check them — read the files before installing.
License
MIT (declared in the SKILL.md frontmatter); the repo is a mirror synced from microsoft/GitHub-Copilot-for-Azure and has no top-level LICENSE file in our copy. Commercial use allowed under MIT.
Can it run unattended?
Not really. The step-by-step workflow script is resumable through a status file, but it needs a prepared plan and the user's intent for the next step, so it is not meant to run unattended.
Alternatives
Google Agent Skills
google/skillsGoogle's official collection of about 180 skills for Google Cloud, Gemini APIs, Analytics, Data Manager, sign-in and other Google products.
Recommended
Broad access Depth 3/5
Cloudflare Skills
cloudflare/skillsCloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.
Recommended
Check first Depth 4/5
FAQ
What does azure-validate check?
Configuration (azure.yaml), Bicep or Terraform infrastructure, RBAC role assignments, managed-identity permissions and deployment prerequisites, using a workflow script that records progress in .azure/validate-status.json.
Do I need azure-validate before azure-deploy?
Yes. azure-deploy refuses to run unless the plan status is Validated, and only azure-validate is allowed to set that status after running the checks.
Will azure-validate deploy my app?
No. It validates and records proof. It only invokes azure-deploy if you explicitly asked to deploy.
How do I install azure-validate?
It is part of Microsoft's Azure plugin: /plugin install azure@claude-plugins-official in Claude Code, or add microsoft/azure-skills to Codex. Azure CLI and azd must be signed in.
Sources: GitHub repository; install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the published SKILL.md.