microsoft-foundry@r1

BLOCKED

Publisher claims: "Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent, managed harness agent, Copilot harness, voice agent, create/update/invoke/evaluate agent, add tool to agent, agent insights, batch/continuous eval, continuous monitoring, agent CI/CD, optimize/improve prompt, optimize agent instructions, Agent Optimizer, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure-prepare)." Observed in sandbox: static analysis only — behavior not yet observed.

Registry skills.shPublisher microsoft · joined 4 days agoInstalls 577KLast detonated 4d ago

Dispute verdict

Is microsoft-foundry@r1 safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-10-22 and scored it 45/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Prompt injection. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL

Access to sensitive file pathsfoundry-agent/create/quick-start-hosted.md:367 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/azd-guidance/references/azd-ai-cli.md:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

File type combined with upload actionfoundry-agent/create/references/local-run.md:142 · File type combined with upload action — agent may exfiltrate local data files

AST07

CRITICAL

Prompt injectionfoundry-agent/create/references/guardrails/guardrail-api-create.md:42 · Prompt injection — known jailbreak technique reference

AST01

CRITICAL

Access to sensitive file pathsfoundry-agent/create/create-hosted.md:216 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/azd-guidance/azd-guidance.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/create/references/local-run.md:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/create/create-hosted.md:228 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/create/quick-start-hosted.md:226 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Credential pass-through configurationfinetuning/references/training-curves.md:12 · Credential pass-through configuration — agent relays sensitive credentials

AST02

CRITICAL

Prompt injectionfoundry-agent/create/references/guardrails/guardrail-manage.md:56 · Prompt injection — known jailbreak technique reference

AST01

MEDIUM

MCP server using network transport (SSE/HTTP)foundry-agent/create/references/foundry-tool-catalog.md:423 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

CRITICAL

Access to sensitive file pathsfoundry-agent/create/quick-start-hosted.md:224 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

File type combined with upload actionfinetuning/scripts/evaluate_model.py:196 · File type combined with upload action — agent may exfiltrate local data files

AST07

CRITICAL

Access to sensitive file pathsfoundry-agent/create/references/foundry-tool-catalog.md:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/create/references/local-run.md:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/create/quick-start-hosted.md:217 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsfoundry-agent/create/create-hosted.md:223 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)foundry-agent/create/references/foundry-tool-catalog.md:181 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

Python subprocess execution detectedfinetuning/scripts/deploy_model.py:75 · Python subprocess execution detected

AST05

MEDIUM

File type combined with upload actionfoundry-agent/create/references/foundry-tool-catalog.md:549 · File type combined with upload action — agent may exfiltrate local data files

AST07

CRITICAL

Access to sensitive file pathsfoundry-agent/create/references/local-run.md:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05