Trust Assessment
azure-image-builder received a trust score of 90/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Recommendation of Excessive Permissions, Unpinned Dependency Version.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 11, 2026 (commit 98272896). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Recommendation of Excessive Permissions The skill recommends granting the 'Contributor' role to the Azure Service Principal. The 'Contributor' role provides broad permissions, allowing management of all resources except access to other users. Adhering to the principle of least privilege, it is generally more secure to grant only the specific permissions required for the Packer build process, rather than a broad role like 'Contributor'. This reduces the blast radius in case the service principal's credentials are compromised. Recommend using a custom Azure role with only the necessary permissions for Packer operations (e.g., creating/managing resource groups, virtual machines, storage accounts, and images), or a more specific built-in role if one exists that meets the exact requirements without being overly permissive. | Static | SKILL.md:104 | |
| LOW | Unpinned Dependency Version The Packer Azure plugin is specified with a pessimistic version constraint `~> 2.0`. While this prevents major version upgrades, it allows any patch or minor version within the 2.x series. This introduces a slight supply chain risk, as a new minor or patch version could potentially introduce a vulnerability or breaking change without explicit review. Pinning to an exact version (e.g., `2.0.1`) provides more deterministic builds and reduces the risk of unexpected changes. Pin the Packer Azure plugin to an exact version (e.g., `version = "2.0.1"`) to ensure deterministic builds and reduce the risk of unexpected changes from new minor or patch releases. Regularly review and manually update the pinned version as needed. | Static | SKILL.md:20 |
Scan History
Embed Code
[](https://skillshield.io/report/9d734acc33c92afa)
Powered by SkillShield