Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Azure Security Scanner Skill · a5c-ai | DecimalAI

a5c-ai/azure-security-scanner

SkillScore96Maintained

Azure security configuration scanning and hardening using Azure Security Center, Azure Policy, and ScoutSuite

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-azure-security-scanner/SKILL.md

decimalai skills pull a5c-ai-azure-security-scanner --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-azure-security-scanner/SKILL.md https://app.decimal.ai/s/a5c-ai-azure-security-scanner/SKILL.md

Raw file: /s/a5c-ai-azure-security-scanner/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-azure-security-scanner.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 22d ago

Yes — +52% lift · at higher cost+27% tokens0% turns96% of whole cases pass with skill (22/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	-10%	0%
case-03	✗→✓	▲ Improved	88%	0%
case-04	✗→✓	▲ Improved	32%	0%
case-06	✗→✓	▲ Improved	-56%	0%
case-08	✗→✓	▲ Improved	67%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/azure-security-scanner/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

Azure Security Scanner Skill

Purpose

Automated Azure security configuration scanning and hardening to identify misconfigurations, compliance violations, and security risks across Azure subscriptions and tenants.

Capabilities

Azure Security Center Assessments

Run Microsoft Defender for Cloud security assessments
Check secure score and recommendations
Review security alerts and incidents
Validate just-in-time VM access
Check adaptive application controls
Monitor regulatory compliance dashboards

Azure AD Security Analysis

Analyze Azure AD conditional access policies
Check MFA enforcement status
Review privileged identity management (PIM)
Identify risky sign-ins and users
Analyze app registrations and service principals
Check guest user access configurations

Network Security Group Analysis

Review NSG rules for overly permissive access
Check for open management ports (RDP, SSH)
Validate application security groups
Review Azure Firewall configurations
Check DDoS protection status
Analyze virtual network configurations

Storage Account Security

Identify publicly accessible storage accounts
Check encryption configurations (SSE, CMK)
Review shared access signatures (SAS)
Validate network access rules
Check secure transfer requirements
Review access keys rotation

Key Vault Security

Check Key Vault access policies
Validate network restrictions
Review key expiration policies
Check certificate configurations
Verify soft-delete enablement
Audit secret access patterns

Activity Logging Verification

Validate Azure Activity Log configuration
Check diagnostic settings on resources
Review Log Analytics workspace security
Verify Azure Monitor alert rules
Check Azure Sentinel integration

Azure Policy Compliance

Assess built-in policy compliance
Check custom policy assignments
Review policy exemptions
Validate initiative assignments
Generate compliance reports

Azure Services Covered

| Category | Services | |----------|----------| | Identity | Azure AD, PIM, Conditional Access | | Compute | VMs, App Services, Functions, AKS | | Storage | Storage Accounts, Blobs, Files | | Database | SQL Database, Cosmos DB, PostgreSQL | | Network | VNets, NSGs, Azure Firewall, WAF | | Security | Defender, Key Vault, Sentinel | | Monitoring | Monitor, Log Analytics, Application Insights |

Integrations

Microsoft Defender for Cloud: Cloud security posture management
Azure Policy: Governance and compliance
Azure AD: Identity security
ScoutSuite: Multi-cloud security auditing
Azure Sentinel: SIEM and SOAR

Target Processes

Cloud Security Architecture Review
Compliance Monitoring
Azure Subscription Hardening
Security Posture Assessment

Input Schema

json
{
  "type": "object",
  "properties": {
    "scanType": {
      "type": "string",
      "enum": ["full", "cis", "pci", "hipaa", "iso27001", "custom"],
      "description": "Type of security scan"
    },
    "subscriptions": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Azure subscription IDs to scan"
    },
    "resourceGroups": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific resource groups to scan"
    },
    "services": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Specific services to scan"
    },
    "severityThreshold": {
      "type": "string",
      "enum": ["critical", "high", "medium", "low"]
    },
    "complianceFrameworks": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["CIS", "PCI-DSS", "HIPAA", "ISO27001", "SOC2", "NIST"]
      }
    },
    "includeAzureAD": {
      "type": "boolean",
      "description": "Include Azure AD security checks"
    }
  },
  "required": ["scanType"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "scanId": {
      "type": "string"
    },
    "scanTimestamp": {
      "type": "string",
      "format": "date-time"
    },
    "subscriptionsScanned": {
      "type": "array"
    },
    "secureScore": {
      "type": "object",
      "properties": {
        "current": { "type": "number" },
        "max": { "type": "number" },
        "percentage": { "type": "number" }
      }
    },
    "summary": {
      "type": "object",
      "properties": {
        "totalChecks": { "type": "integer" },
        "passed": { "type": "integer" },
        "failed": { "type": "integer" },
        "warnings": { "type": "integer" }
      }
    },
    "findingsBySeverity": {
      "type": "object",
      "properties": {
        "critical": { "type": "integer" },
        "high": { "type": "integer" },
        "medium": { "type": "integer" },
        "low": { "type": "integer" }
      }
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "checkId": { "type": "string" },
          "severity": { "type": "string" },
          "service": { "type": "string" },
          "resourceId": { "type": "string" },
          "description": { "type": "string" },
          "remediation": { "type": "string" },
          "complianceMapping": { "type": "array" }
        }
      }
    },
    "azureAdFindings": {
      "type": "array"
    },
    "policyCompliance": {
      "type": "object"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}

Usage Example

javascript
skill: {
  name: 'azure-security-scanner',
  context: {
    scanType: 'cis',
    subscriptions: ['subscription-id-1'],
    complianceFrameworks: ['CIS', 'SOC2'],
    includeAzureAD: true,
    severityThreshold: 'medium'
  }
}

Illustrative Want to see what a5c-ai/azure-security-scanner would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 17:54 UTC · 23 cases

Lift

+52%

96% vs 43%

Agent turns

0%

1.0 vs 1.0

Tokens

+27%

3,032.26 vs 2,381.65

fail → pass · 12pass → pass · 10fail → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Please perform a security and compliance audit on my Azure subscription 'sub-finance-prod' to check our payment card data handling posture. Include identity checks for Azure AD like multi-factor authentication and privileged access. Deliver the report with an overall secure score, summary of passed/failed checks, a list of critical and high severity findings complete with affected resource IDs and remediation guidelines, along with strategic recommendations.	fail→fail	40,458	28,108	-31%	1	1	0%	6,707	4,213	-37%	0	0	—
case-02 Run a CIS benchmark security scan across our core Azure environment for subscription '00000000-1111-2222-3333-444444444444'. Focus on networking configurations, public storage access, and key vault policies. Structure the result with scan metadata, score metrics, check counts, severity distribution, itemized findings with compliance mappings, and Azure policy compliance summaries.	fail→pass	26,949	32,672	+21%	1	1	0%	5,521	4,952	-10%	0	0	—
case-03 I need a targeted security review for resource groups 'rg-frontend-prod' and 'rg-backend-prod' covering virtual networks, databases, and key vaults. Generate an output containing the scan timestamp, check statistics, findings categorized by severity level with clear descriptions and fix recommendations, as well as an identity security assessment.	fail→pass	29,540	41,631	+41%	1	1	0%	3,341	6,275	+88%	0	0	—
case-04 I want to configure an input payload for an Azure security scanner for payment card compliance against subscription 'sub-pay-999'. I am tempted to use 'PCI' or 'PCIDSS' as the framework name in the complianceFrameworks array. What is the exact string value defined in the input schema for PCI compliance?	fail→pass	8,997	8,899	-1%	1	1	0%	1,559	2,063	+32%	0	0	—
case-05 When invoking an Azure security scan for an ISO 27001 audit on subscription 'sub-123', I want to specify the scanType input parameter. Should I pass 'iso' or 'iso27001' or 'standard'?	pass→pass	58,030	11,111	-81%	1	1	0%	2,489	2,122	-15%	0	0	—
case-06 In an input configuration payload for an Azure security scan, which single property is explicitly declared as required in the input schema specification?	fail→pass	30,477	12,734	-58%	1	1	0%	4,177	1,834	-56%	0	0	—
case-07 We want to set a severity filter so only relevant findings are reported during an Azure scan. What are the allowed enum values for severityThreshold in the Azure security scanner input schema?	pass→pass	15,641	55,073	+252%	1	1	0%	1,712	1,789	+4%	0	0	—
case-08 Construct a JSON response for a failed Azure Key Vault access policy check on resource '/subscriptions/sub-1/resourceGroups/rg-sec/providers/Microsoft.KeyVault/vaults/kv-prod'. What fields must each finding item in the 'findings' array contain?	fail→pass	18,772	15,152	-19%	1	1	0%	2,142	3,577	+67%	0	0	—
case-09 Provide a JSON snippet representing the secureScore field for an Azure subscription security scan where the current score is 45 out of 60. What keys must be present inside secureScore?	pass→pass	84,252	8,826	-90%	1	1	0%	1,494	2,071	+39%	0	0	—
case-10 What four count properties compose the 'summary' object in the Azure security scanner JSON output schema?	fail→pass	18,096	1,904	-89%	1	1	0%	1,903	1,866	-2%	0	0	—
case-11 Generate the JavaScript/JSON skill context object to run a CIS benchmark scan on Azure subscription 'sub-corp-01', including Azure AD checks and setting severity threshold to medium.	fail→pass	13,927	9,113	-35%	1	1	0%	1,651	2,109	+28%	0	0	—
case-12 We need to invoke a HIPAA compliance scan across Azure subscriptions 'sub-health-1' and 'sub-health-2'. Build the input JSON payload with complianceFrameworks configured for HIPAA and scanType set to hipaa.	pass→pass	3,000	8,826	+194%	1	1	0%	490	2,303	+370%	0	0	—
case-13 Draft an input payload for a custom scan targeting specific resource groups 'rg-app-east' and 'rg-data-east' with severity threshold 'high'.	pass→pass	12,469	7,669	-38%	1	1	0%	1,402	2,008	+43%	0	0	—
case-14 Run an Azure AD security scan for subscription 'sub-identity-01' with includeAzureAD set to true. Generate the scan output JSON structure showing an Azure AD finding for unmanaged MFA enforcement.	fail→pass	24,057	43,180	+79%	1	1	0%	1,889	3,410	+81%	0	0	—
case-15 Generate a scan output JSON for an Azure Network Security Group check that detected open RDP port 3389 to the public internet on NSG 'nsg-web-prod'.	pass→pass	15,588	14,013	-10%	1	1	0%	2,140	3,266	+53%	0	0	—
case-16 Generate a JSON scan output for storage account 'stproddata01' found with public blob access enabled under PCI-DSS compliance scanning.	fail→pass	15,057	15,794	+5%	1	1	0%	1,937	3,789	+96%	0	0	—
case-17 Perform a Key Vault security audit scan output in JSON for subscription 'sub-kv-test' checking soft-delete and purge protection status.	fail→pass	17,780	18,748	+5%	1	1	0%	1,940	3,213	+66%	0	0	—
case-22 Run an AWS Security Hub posture scan across AWS account '123456789012' using AWS CLI commands to list active controls and findings.	pass→pass	14,288	18,228	+28%	1	1	0%	1,806	3,522	+95%	0	0	—
case-18 Which regulatory compliance framework options are supported in the complianceFrameworks input enum list for Azure security scanning?	pass→pass	13,382	3,635	-73%	1	1	0%	2,545	1,793	-30%	0	0	—
case-19 Generate a JSON scan result for Azure subscription 'sub-log-001' missing diagnostic settings on its activity log.	fail→pass	15,450	13,694	-11%	1	1	0%	2,095	3,362	+60%	0	0	—
case-20 Write an Azure Bicep template to automatically disable public blob access on Azure storage account 'stsecprod01' and set minTlsVersion to TLS1_2.	pass→pass	17,412	14,397	-17%	1	1	0%	1,663	3,285	+98%	0	0	—
case-21 Write an Azure Sentinel KQL (Kusto Query Language) query to detect multiple failed Azure AD login attempts from a single IP address within 10 minutes followed by a successful login.	pass→pass	19,128	16,844	-12%	1	1	0%	2,789	4,773	+71%	0	0	—
case-23 Create a full security scan request payload for subscription 'sub-enterprise-core' with severity threshold set to 'low' and requesting all supported compliance frameworks.	fail→pass	14,076	43,319	+208%	1	1	0%	1,386	2,147	+55%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +52 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 43.5%
Pass rate with the skill: 95.7%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 17:54 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

Run a CIS benchmark security scan across our core Azure environment for subscription '00000000-1111-2222-3333-444444444444'. Focus on networking configurations, public storage access, and key vault policies. Structure the result with scan metadata, score metrics, check counts, severity distribution, itemized findings with compliance mappings, and Azure policy compliance summaries.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run96

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+45% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 21 days ago

Other measured skills in the registry, with their headline benchmark lift.