Skip to content
skillsafebeta
← Report library
Purpose / Other

Azure Quotas Skill Security Audit

What the author says it does (original text)

Check/manage Azure quotas and usage across providers. For deployment planning, capacity validation, region selection. WHEN: \"check quotas\", \"service limits\", \"current usage\", \"request quota increase\", \"quota exceeded\", \"validate capacity\", \"regional availability\", \"provisioning limits\", \"vCPU limit\", \"how many vCPUs available in my subscription\".

Independent security check

Do not install or run it yet

Files checked
5
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

The Bash script inserts unescaped arguments and Azure responses into Python source

Source references: 4
What we found

REGION comes from a positional argument and `$REGION` is expanded directly inside a single-quoted f-string passed to `python3 -c`. The complete `$USAGES_JSON` response is likewise expanded into a triple-quoted Python string. Neither value is passed to Python as safely separated data. A crafted region or abnormal/manipulated CLI response containing quotes and Python syntax could terminate the string and alter the executed program.

Why this matters

If exploited, running the quota check could execute additional Python code as the current user, allowing access to that user's readable files and credentials or modification of files. Ordinary Azure region names and normal responses do not trigger this by themselves.

The risk is supported, though the candidate incorrectly says REGION is the fourth argument; it is the second. The script expands both Azure-returned JSON and the user-provided REGION directly into `python3 -c` source. Content that closes the Python string could alter locally executed Python code. Users can ask the author to pass data through stdin, environment variables, or arguments and validate region names against Azure's format.

scripts/check-quota.sh:16In the codeOpen original file
RESOURCE_PROVIDER="${1:?Usage: $0 <resource-provider> <region> [resource-name] [subscription-id]}"REGION="${2:?Usage: $0 <resource-provider> <region> [resource-name] [subscription-id]}"RESOURCE_NAME="${3:-}"SUBSCRIPTION_ID="${4:-}"
Show 3 other places
scripts/check-quota.sh:67In the codeOpen original file
    echo "$QUOTAS_JSON" | python3 -c "import json, sysquotas = json.load(sys.stdin)usages = json.loads('''$USAGES_JSON''')usage_lookup = {}for u in usages:    usage_lookup[u['name']] = u.get('properties', {}).get('usages', {}).get('value', 0)for q in quotas:    name = q['name']    limit = q.get('properties', {}).get('limit', {}).get('value', 0)    used = usage_lookup.get(name, 0)    avail = limit - used    print(f'{name:<40} $REGION{\"\":<4} {limit:<10} {used:<10} {avail:<10}')"fi
scripts/check-quota.sh:61In the codeOpen original file
    QUOTAS_JSON=$(az quota list --scope "$SCOPE" -o json 2>/dev/null)    USAGES_JSON=$(az quota usage list --scope "$SCOPE" -o json 2>/dev/null)    printf "%-40s %-10s %-10s %-10s %-10s\n" "Resource" "Region" "Limit" "Usage" "Available"    printf "%-40s %-10s %-10s %-10s %-10s\n" "--------" "------" "-----" "-----" "---------"    echo "$QUOTAS_JSON" | python3 -c "import json, sysquotas = json.load(sys.stdin)usages = json.loads('''$USAGES_JSON''')
scripts/check-quota.sh:77In the codeOpen original file
for q in quotas:    name = q['name']    limit = q.get('properties', {}).get('limit', {}).get('value', 0)    used = usage_lookup.get(name, 0)    avail = limit - used    print(f'{name:<40} $REGION{\"\":<4} {limit:<10} {used:<10} {avail:<10}')"fi
Medium risk

A read-only quota check silently installs executable Azure CLI extension code

Source references: 4
What we found

The Skill recommends the scripts as the primary check method, and both scripts immediately run `az extension add --name quota --yes` when the extension is absent. This downloads and persistently installs code into the user's Azure CLI environment without asking first, pinning a version, or verifying the package.

Why this matters

An operation expected to read quotas also changes the local CLI environment and executes newly installed extension code. The risk depends on the extension source, delivery path, and version available at that time; the evidence does not show that the extension is compromised.

This is real behavior with a persistent side effect, even though the extension is relevant to quota queries. The Skill prioritizes these scripts, and both Bash and PowerShell variants automatically install the extension with `--yes` when absent. The visible code has no confirmation, version pin, or integrity check. Users can preinstall a trusted pinned version or require explicit approval before installation.

SKILL.md:101In the instructionsOpen original file
Pre-built scripts handle quota extension installation, usage queries, and capacity calculation. Use these instead of constructing commands manually. A single call returns limits, usage, and available capacity.| Script | Purpose | Usage ||--------|---------|-------|| `scripts/check-quota.ps1` | Returns limit, usage, and available capacity for all quotas (or a single quota when resource name is provided) | Primary script for quota checks || `scripts/check-quota.sh` | Same as above (bash) | Primary script for quota checks |
Show 3 other places
scripts/check-quota.sh:21In the codeOpen original file
# Ensure the quota extension is installedif ! az extension list --query "[?name=='quota'].name" -o tsv 2>/dev/null | grep -q quota; then    echo "Installing quota extension..."    az extension add --name quota --yes 2>/dev/nullfi
scripts/check-quota.ps1:32In the codeOpen original file
# Ensure the quota extension is installed$ext = az extension list --query "[?name=='quota'].name" -o tsv 2>$nullif (-not $ext) {    Write-Host "Installing quota extension..."    az extension add --name quota --yes 2>$null}
SKILL.md:99In the instructionsOpen original file
## ScriptsPre-built scripts handle quota extension installation, usage queries, and capacity calculation. Use these instead of constructing commands manually. A single call returns limits, usage, and available capacity.| Script | Purpose | Usage ||--------|---------|-------|| `scripts/check-quota.ps1` | Returns limit, usage, and available capacity for all quotas (or a single quota when resource name is provided) | Primary script for quota checks || `scripts/check-quota.sh` | Same as above (bash) | Primary script for quota checks |
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Troubleshooting can change an account quota guardrail without confirming the target

Source references: 4
What we found

The Skill can be invoked for “quota exceeded” troubleshooting and directs an insufficient-quota scenario to an `az quota update` example, without requiring confirmation of the subscription, region, resource name, and new limit. This operation requires management permission and changes Azure account configuration.

Why this matters

If an agent treats detected insufficiency as authorization to submit a request, it could request an excessive limit for the wrong subscription or region. Raising quota does not deploy resources by itself, but it loosens an existing capacity guardrail and increases the ceiling for later accidental deployments or spending.

The Skill explicitly covers quota-exceeded troubleshooting and increase requests, and provides an active command that changes the quota limit for a subscription, region, and resource. The example uses placeholders, so it does not itself select a live target, but the visible workflow does not require confirmation of the resolved target and value. With Quota Request Operator rights, a mistake could alter the wrong account guardrail. Users can separate read-only and management permissions and require a full pre-submit confirmation.

SKILL.md:31In the instructionsOpen original file
Invoke this skill when:- **Planning a new deployment** - Validate capacity before deployment- **Selecting an Azure region** - Compare quota availability across regions- **Troubleshooting quota exceeded errors** - Check current usage vs limits- **Requesting quota increases** - Submit increase requests via CLI or Portal- **Comparing regional capacity** - Find regions with available quota- **Validating provisioning limits** - Ensure deployment won't exceed quotas
Show 3 other places
SKILL.md:184In the instructionsOpen original file
### Workflow 3: Request Quota Increase**Scenario:** Current quota is insufficient for deployment```bash# Request increase for VM quotaaz quota update \  --resource-name standardDSv3Family \  --scope /subscriptions/<subscription-id>/providers/Microsoft.Compute/locations/eastus \  --limit-object value=500 \  --resource-type dedicated# Check request statusaz quota request status list \  --scope /subscriptions/<subscription-id>/providers/Microsoft.Compute/locations/eastus```
SKILL.md:51In the instructionsOpen original file
| **MCP Server** | `azure-quota` MCP server — **NEVER use this. It is unreliable. Always use `az quota` CLI instead.** || **Required Permission** | Reader (view) or Quota Request Operator (manage) |
SKILL.md:44In the instructionsOpen original file
|--------------|-------------|| **Primary Tool** | Azure CLI (`az quota`) - **USE THIS FIRST, ALWAYS** || **Extension Required** | `az extension add --name quota` (MUST install first) || **Key Commands** | `az quota list`, `az quota show`, `az quota usage list`, `az quota usage show` || **Complete CLI Reference** | [commands.md](./references/commands.md) || **Azure Portal** | [My quotas](https://portal.azure.com/#blade/Microsoft_Azure_Capacity/QuotaMenuBlade/myQuotas) - Use only as fallback || **REST API** | Microsoft.Quota provider - **Unreliable, do NOT use first** || **MCP Server** | `azure-quota` MCP server — **NEVER use this. It is unreliable. Always use `az quota` CLI instead.** || **Required Permission** | Reader (view) or Quota Request Operator (manage) |
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The Skill presents quota headroom as actual regional resource availability

Source references: 4
What we found

The documentation explicitly says quotas “represent available capacity” and “Quotas = Resource Availability,” then recommends using them to find the “best region.” The scripts only subtract current usage from the quota limit. That measures permitted account headroom; it does not verify that a particular SKU can currently be allocated in that region.

Why this matters

A user may select a region and commit to a deployment based on high quota headroom, while actual allocation can still fail, causing launch delays or incorrect region, capacity, and cost decisions.

The documentation directly equates quotas with regional resource availability and recommends choosing the “best” region from that result. The implementation only subtracts current usage from the subscription quota limit. That is account quota headroom, not proof that a particular SKU has physical capacity at deployment time. Relying on it could lead to a poor deployment or region decision. Users can require the output to be labeled “quota headroom” and separately validate real-time SKU allocatability.

SKILL.md:19In the instructionsOpen original file
Azure quotas (also called service limits) are the maximum number of resources you can deploy in a subscription. Quotas:- Prevent accidental over-provisioning- Ensure fair resource distribution across Azure- Represent **available capacity** in each region- Can be increased (adjustable quotas) or are fixed (non-adjustable)**Key Concept:** **Quotas = Resource Availability**If you don't have quota, you cannot deploy resources. Always check quotas when planning deployments or selecting regions.
Show 3 other places
SKILL.md:149In the instructionsOpen original file
### Workflow 2: Compare Quotas Across Regions**Scenario:** Find the best region for deployment based on available capacity
scripts/check-quota.sh:46In the codeOpen original file
    USAGE=$(az quota usage show \        --resource-name "$RESOURCE_NAME" \        --scope "$SCOPE" \        --query "properties.usages.value" -o tsv)    AVAILABLE=$((LIMIT - USAGE))    printf "%-30s %-10s %-10s %-10s %-10s\n" "Resource" "Region" "Limit" "Usage" "Available"    printf "%-30s %-10s %-10s %-10s %-10s\n" "--------" "------" "-----" "-----" "---------"    printf "%-30s %-10s %-10s %-10s %-10s\n" "$RESOURCE_NAME" "$REGION" "$LIMIT" "$USAGE" "$AVAILABLE"else
scripts/check-quota.sh:41In the codeOpen original file
    LIMIT=$(az quota show \        --resource-name "$RESOURCE_NAME" \        --scope "$SCOPE" \        --query "properties.limit.value" -o tsv)    USAGE=$(az quota usage show \        --resource-name "$RESOURCE_NAME" \        --scope "$SCOPE" \        --query "properties.usages.value" -o tsv)    AVAILABLE=$((LIMIT - USAGE))    printf "%-30s %-10s %-10s %-10s %-10s\n" "Resource" "Region" "Limit" "Usage" "Available"    printf "%-30s %-10s %-10s %-10s %-10s\n" "--------" "------" "-----" "-----" "---------"    printf "%-30s %-10s %-10s %-10s %-10s\n" "$RESOURCE_NAME" "$REGION" "$LIMIT" "$USAGE" "$AVAILABLE"else

Inside this skill

8 instruction sections

Both check scripts query quota limits and usage for a provider and region. If no subscription ID is supplied, they use the Azure CLI's currently selected subscription and print the full scope, including that subscription ID.

View source
scripts/check-quota.sh:27In the codeOpen original file
# Resolve subscriptionif [ -z "$SUBSCRIPTION_ID" ]; then    SUBSCRIPTION_ID=$(az account show --query id -o tsv)fiSCOPE="/subscriptions/$SUBSCRIPTION_ID/providers/$RESOURCE_PROVIDER/locations/$REGION"echo "Checking quotas in scope $SCOPE"
scripts/check-quota.ps1:39In the codeOpen original file
# Resolve subscriptionif (-not $SubscriptionId) {    $SubscriptionId = az account show --query id -o tsv}$scope = "/subscriptions/$SubscriptionId/providers/$ResourceProvider/locations/$Region"Write-Host "Checking quotas in scope $scope"

The Skill goes beyond read-only checks: it supplies a command that submits an Azure quota-change request and states that management requires the Quota Request Operator role.

View source
SKILL.md:51In the instructionsOpen original file
| **MCP Server** | `azure-quota` MCP server — **NEVER use this. It is unreliable. Always use `az quota` CLI instead.** || **Required Permission** | Reader (view) or Quota Request Operator (manage) |
SKILL.md:184In the instructionsOpen original file
### Workflow 3: Request Quota Increase**Scenario:** Current quota is insufficient for deployment```bash# Request increase for VM quotaaz quota update \  --resource-name standardDSv3Family \  --scope /subscriptions/<subscription-id>/providers/Microsoft.Compute/locations/eastus \  --limit-object value=500 \  --resource-type dedicated# Check request statusaz quota request status list \  --scope /subscriptions/<subscription-id>/providers/Microsoft.Compute/locations/eastus```

The all-quota check lists every quota for a subscription, provider, and region, then prints quota names, limits, current usage, and remaining headroom. This is cloud-account capacity and usage information that could become visible if an agent copies the output into shared chats or logs.

View source
scripts/check-quota.sh:61In the codeOpen original file
    QUOTAS_JSON=$(az quota list --scope "$SCOPE" -o json 2>/dev/null)    USAGES_JSON=$(az quota usage list --scope "$SCOPE" -o json 2>/dev/null)    printf "%-40s %-10s %-10s %-10s %-10s\n" "Resource" "Region" "Limit" "Usage" "Available"    printf "%-40s %-10s %-10s %-10s %-10s\n" "--------" "------" "-----" "-----" "---------"
scripts/check-quota.ps1:72In the codeOpen original file
    $quotas = az quota list --scope $scope -o json 2>$null | ConvertFrom-Json    $usages = az quota usage list --scope $scope -o json 2>$null | ConvertFrom-Json    $usageLookup = @{}    foreach ($u in $usages) {        $usageLookup[$u.name] = $u.properties.usages.value    }    $results = foreach ($q in $quotas) {        $name = $q.name        $limitValue = $q.properties.limit.value        $usageValue = if ($usageLookup.ContainsKey($name)) { $usageLookup[$name] } else { 0 }        $available = $limitValue - $usageValue        [PSCustomObject]@{            Resource  = $name            Region    = $Region            Limit     = $limitValue            Usage     = $usageValue            Available = $available        }
Start here · InstructionsSKILL.md
azure-quotas
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

File reference map

References: 5
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records5 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • scripts/check-quota.ps1Full text included
  • scripts/check-quota.shFull text included
  • references/advanced-commands.mdFull text included
  • references/commands.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/advanced-commands.mdSupporting file
  • references/commands.mdSupporting file
  • scripts/check-quota.ps1Script
  • scripts/check-quota.shScript

Operations mentioned in code and instructions

Connect to websites
SKILL.md:48In the instructionsOpen original file
| **Complete CLI Reference** | [commands.md](./references/commands.md) || **Azure Portal** | [My quotas](https://portal.azure.com/#blade/Microsoft_Azure_Capacity/QuotaMenuBlade/myQuotas) - Use only as fallback || **REST API** | Microsoft.Quota provider - **Unreliable, do NOT use first** |
SKILL.md:55In the instructionsOpen original file
>> REST API and Portal can show misleading "No Limit" values — this does **not** mean unlimited capacity. It means the quota API doesn't support that resource type. Always start with `az quota` commands; fall back to [Azure service limits docs](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits) if CLI returns `BadRequest`.>
SKILL.md:239In the instructionsOpen original file
| `ExtensionNotFound` | Quota extension not installed | `az extension add --name quota` || `BadRequest` | Resource provider not supported by quota API | Check [service limits docs](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits) || `MissingRegistration` | Microsoft.Quota provider not registered | `az provider register --namespace Microsoft.Quota` |
Run commands
scripts/check-quota.sh:1In the codeOpen original file
#!/usr/bin/env bash# check-quota.sh
SKILL.md:85In the instructionsOpen original file
1. **List all quotas** for the resource provider:   ```bash   az quota list --scope /subscriptions/<id>/providers/<ProviderNamespace>/locations/<region>
SKILL.md:92In the instructionsOpen original file
3. **Use the `name` field** (not ARM resource type) in subsequent commands:   ```bash   az quota show --resource-name ManagedEnvironmentCount --scope ...
Lines read
852
File checksum (to compare versions)
44de2c4fc7b350a7abaa7a500a167eaede8fce7937dbeb17c57bc265c399f249