跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Azure Cost Skill 安全审计

作者说它能做什么（原文）

Azure cost management: query costs, forecast spending, optimize to reduce waste. WHEN: \"Azure costs\", \"Azure bill\", \"cost breakdown\", \"how much am I spending\", \"forecast spending\", \"optimize costs\", \"reduce spending\", \"orphaned resources\", \"rightsize VMs\", \"cost spike\", \"reduce storage costs\", \"AKS cost\". DO NOT USE FOR: deploying resources, provisioning, diagnostics, or se

第三方安全检查结论

发现安全风险

已检查文件
23
发现的风险
6
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
中风险

存在多个范围标识时，规则可能优先读取更广的管理组

原文依据：2 处
发现了什么

范围优先级把“最广的组织范围”Management Group 放在第一位，而 Resource Group 和 Subscription 排在其后。这可能扩大成本和资源查询范围。

为什么需要注意

代理可能读取并汇总用户当前问题不需要的其他订阅、资源组及组织级费用和资源元数据，使更多敏感经营信息进入响应和本地报告。

这是生效的范围选择规则：当上下文中有多个标识时，它把“最广的组织范围”管理组排在资源组和订阅之前。若用户同时提供这些标识，成本或资源查询可能覆盖超出其预期的订阅，并暴露更广的组织数据。用户可要求每次显示最终范围并在管理组级查询前确认。

cost-query/dimensions-by-scope.md:155来自说明文档打开原文件
## Scope Resolution PriorityWhen multiple scope identifiers are available in context, use the following priority order (highest first):| Priority | Scope | Notes ||----------|-------|-------|| 1 | Management Group | Broadest organizational scope. || 2 | Resource Group | Narrowest resource scope. || 3 | Subscription | Default scope for most queries. || 4 | Billing Profile + Invoice Section | MCA billing hierarchy. |
查看另外 1 个位置
cost-query/workflow.md:5来自说明文档打开原文件
## Step 1: Determine ScopeIdentify the Azure scope for the cost query from the Scope Reference table in the main [SKILL.md](../SKILL.md#scope-reference-shared-across-all-workflows).
低风险

费用查询结果和资源门户链接会作为审计材料长期保存在工作区

原文依据：5 处
发现了什么

技能要求保存所有查询和响应，并在报告中加入含租户、订阅、资源组及资源名称的 Azure Portal 链接。没有给出保存期限或文件访问限制。

为什么需要注意

共享工作区、备份、制品上传或后续提交可能暴露费用、资源结构、租户和订阅标识等经营元数据；源码未显示主动外传。

技能要求保存全部查询和响应、带时间戳的成本结果，以及包含租户、订阅、资源组和资源名的门户链接。这会在 `output/` 中留下敏感的账单与资源清单；仅临时目录被清理，源码没有规定输出的保留期或访问控制。用户可限制输出位置和权限、要求脱敏，并约定自动过期或删除时间。

references/tools-and-best-practices.md:29来自说明文档打开原文件
- Always include the `ClientType: GitHubCopilotForAzure` header on all Cost Management API requests (`--headers "ClientType=GitHubCopilotForAzure"` in `az rest`)- Save audit trail with all queries and responses- Include Azure Portal links for all resources- For costs < $10/month, emphasize operational improvements over financial savings
查看另外 4 个位置
cost-optimization/report-template.md:53来自说明文档打开原文件
Include Azure Portal links for all resources using this format:```texthttps://portal.azure.com/#@<TENANT_ID>/resource/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/<RESOURCE_PROVIDER>/<RESOURCE_TYPE>/<RESOURCE_NAME>/overview```
cost-optimization/report-template.md:59来自说明文档打开原文件
## Audit TrailSave cost query results to `output/cost-query-result<YYYYMMDD_HHMMSS>.json` for reproducibility.
cost-optimization/workflow.md:194来自说明文档打开原文件
## Step 7: Generate Optimization ReportGenerate a report to `output/costoptimizereport<YYYYMMDD_HHMMSS>.md` that includes an executive summary, cost breakdown by service, free tier analysis, orphaned resources, prioritized optimization recommendations, and implementation commands. Save cost query results to `output/cost-query-result<YYYYMMDD_HHMMSS>.json` for audit trail, then clean up temporary files.
cost-optimization/report-template.md:63来自说明文档打开原文件
## CleanupAfter generating the report, remove temporary files:```powershellRemove-Item -Path "temp" -Recurse -Force -ErrorAction SilentlyContinue```
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。发现 3 项风险
中风险

清理命令会递归强制删除整个相对 temp 目录

原文依据：2 处
发现了什么

流程只创建并使用 `temp/cost-query.json` 等特定文件，但最终模板删除整个 `temp` 目录，而不是只删除技能创建的文件。

为什么需要注意

如果当前工作目录中原本已有名为 temp 的目录，其中无关文件也会被递归且强制删除；静默忽略错误会使损失不易被发现。

流程在相对路径 `temp` 中创建查询文件，但清理步骤递归、强制删除整个 `temp` 目录，而不是仅删除本技能创建的文件。如果用户工作目录原本已有同名目录及其他内容，运行清理会一并删除。用户可要求将临时文件放入唯一目录，并只清理已创建的路径。

cost-query/workflow.md:47来自说明文档打开原文件
**Create cost query file:**Create `temp/cost-query.json` with:```json
查看另外 1 个位置
cost-optimization/report-template.md:63来自说明文档打开原文件
## CleanupAfter generating the report, remove temporary files:```powershellRemove-Item -Path "temp" -Recurse -Force -ErrorAction SilentlyContinue```
中风险

基准存储生命周期策略会自动删除 90 天以上的快照和版本

原文依据：4 处
发现了什么

技能建议把一份包含快照和版本自动删除动作的策略作为无生命周期管理账户的“基准”策略。它没有在模板中排除法律保留、备份、不可变数据或关键前缀。

为什么需要注意

一旦部署，超过 90 天的快照和 Blob 版本会被持续自动删除，可能破坏恢复能力、审计记录或合规保留要求。

该文档把此策略作为无生命周期管理账户的基准建议，其中会在创建超过 90 天后自动删除快照和 Blob 版本。模板没有限定关键前缀或列出备份、法律保留等排除条件；一旦用户应用，可能造成数据或恢复点丢失。通用安全要求规定变更前审批和回滚，但没有消除模板本身的风险。用户可要求先列出受影响对象、保留要求和恢复方案。

cost-optimization/services/storage/azure-storage.md:48来自说明文档打开原文件
## Lifecycle Policy TemplateRecommend this baseline policy for accounts without lifecycle management:
查看另外 3 个位置
cost-optimization/services/storage/azure-storage.md:79来自说明文档打开原文件
    },    {      "name": "delete-old-snapshots",      "type": "Lifecycle",      "definition": {        "actions": {          "snapshot": {            "delete": { "daysAfterCreationGreaterThan": 90 }          }        },        "filters": { "blobTypes": ["blockBlob"] }      }
cost-optimization/services/storage/azure-storage.md:91来自说明文档打开原文件
    },    {      "name": "delete-old-versions",      "type": "Lifecycle",      "definition": {        "actions": {          "version": {            "delete": { "daysAfterCreationGreaterThan": 90 }          }        },        "filters": { "blobTypes": ["blockBlob"] }      }
references/tools-and-best-practices.md:45来自说明文档打开原文件
- Get approval before deleting resources- Test changes in non-production first- Provide dry-run commands for validation- Include rollback procedures
中风险

浅层状态规则可能把仍有用途的资源标记为可立即删除

原文依据：6 处
发现了什么

Redis 规则仅凭 Failed 状态或 Creating 超过四小时就建议删除，存储规则仅凭磁盘 `managedBy` 为空就建议删除或快照后删除；报告模板又把孤立资源描述为“可以立即删除”。这些信号本身不能证明无所有者、无数据或无恢复用途。

为什么需要注意

如果用户信任报告并批准命令，仍用于故障调查、灾难恢复、迁移或保留数据的缓存或磁盘可能被删除。

规则把 Redis 的 Failed、Creating 超过四小时，以及磁盘 `managedBy` 为空直接当作删除候选；报告模板还把孤立资源称为“可以立即删除”。这些状态不能单独证明资源没有数据、依赖或恢复用途。虽然另有明确审批要求，错误建议仍可能影响用户决策。用户可要求核实所有者、依赖、近期活动、备份和恢复能力后才提供删除命令。

cost-optimization/services/redis/azure-cache-for-redis.md:21来自说明文档打开原文件
| Priority | Rule | Detection Logic | Recommendation | Avg Savings ||----------|------|----------------|----------------|-------------|| 🔴 Critical | Failed Cache | `provisioningState == 'Failed'` | Delete immediately | $50-300/mo || 🔴 Critical | Stuck Creating | `provisioningState == 'Creating'` AND age >4 hours | Delete/support ticket | $50-300/mo || 🟠 High | Premium in Dev | `sku.name == 'Premium'` AND `tags.environment in ['dev','test','staging']` | Downgrade to Standard | $175/mo |
查看另外 5 个位置
cost-optimization/services/storage/azure-storage.md:21来自说明文档打开原文件
| Priority | Rule | Detection Logic | Recommendation | Avg Savings ||----------|------|----------------|----------------|-------------|| 🔴 Critical | Orphaned Managed Disks (Compute) | Managed disks with `managedBy` empty (billed as storage) | Delete or snapshot and delete | $20-500/mo || 🔴 Critical | Premium in Dev | `sku.name` contains `Premium` AND `tags.environment in ['dev','test','staging']` | Downgrade to Standard | $50-400/mo |
cost-optimization/report-template.md:23来自说明文档打开原文件
## Orphaned Resources (Immediate Savings)[From azqr — resources that can be deleted immediately]
references/tools-and-best-practices.md:32来自说明文档打开原文件
- For costs < $10/month, emphasize operational improvements over financial savings- Never execute destructive operations without explicit approval- On 429 responses, check all `x-ms-ratelimit-microsoft.costmanagement-*-retry-after` headers (`qpu-retry-after`, `entity-retry-after`, `tenant-retry-after`), wait for the longest value, and don't retry until that duration has elapsed. The per-scope limit (4 requests/minute) is the most restrictive.
cost-optimization/services/redis/azure-cache-for-redis.md:23来自说明文档打开原文件
|----------|------|----------------|----------------|-------------|| 🔴 Critical | Failed Cache | `provisioningState == 'Failed'` | Delete immediately | $50-300/mo || 🔴 Critical | Stuck Creating | `provisioningState == 'Creating'` AND age >4 hours | Delete/support ticket | $50-300/mo || 🟠 High | Premium in Dev | `sku.name == 'Premium'` AND `tags.environment in ['dev','test','staging']` | Downgrade to Standard | $175/mo |
cost-optimization/services/storage/azure-storage.md:23来自说明文档打开原文件
|----------|------|----------------|----------------|-------------|| 🔴 Critical | Orphaned Managed Disks (Compute) | Managed disks with `managedBy` empty (billed as storage) | Delete or snapshot and delete | $20-500/mo || 🔴 Critical | Premium in Dev | `sku.name` contains `Premium` AND `tags.environment in ['dev','test','staging']` | Downgrade to Standard | $50-400/mo |
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 1 项风险
低风险

所有成本 API 请求都被标记为 GitHubCopilotForAzure 客户端

原文依据：3 处
发现了什么

技能强制添加 `ClientType=GitHubCopilotForAzure`，即使实际运行它的客户端未被证明是 GitHub Copilot for Azure。

为什么需要注意

Azure 侧的客户端归因、使用遥测和按客户端计算的限流可能记录在该产品名下，使审计记录不能准确表示真实调用来源。

技能明确要求所有成本管理请求携带 `ClientType=GitHubCopilotForAzure`，实际命令也这样发送。若技能运行环境并非该客户端，这会向 Azure 提交可能不准确的客户端标识，影响服务端遥测、配额归因或审计判断；源码未说明 Azure 如何使用该值。用户可要求作者说明该标头的官方要求，并允许非 Copilot 环境省略或改用准确标识。

references/tools-and-best-practices.md:28来自说明文档打开原文件
- Use REST API for cost queries (more reliable than `az costmanagement query`)- Always include the `ClientType: GitHubCopilotForAzure` header on all Cost Management API requests (`--headers "ClientType=GitHubCopilotForAzure"` in `az rest`)- Save audit trail with all queries and responses
查看另外 2 个位置
cost-query/guardrails.md:146来自说明文档打开原文件
|-------|-------|| Per User | 20 requests per minute || Per Scope | 4 requests per minute || Per Tenant | 12 requests per 10 seconds, 60 requests per minute, 600 requests per hour || Per Client Type | 2,000 requests per minute |
cost-query/workflow.md:77来自说明文档打开原文件
# Query using REST API (more reliable than az costmanagement query)az rest --method post `  --url "<scope>/providers/Microsoft.CostManagement/query?api-version=2023-11-01" `  --headers "ClientType=GitHubCopilotForAzure" `  --body '@temp/cost-query.json'```

Skill 逻辑拆解

5 个说明模块

该技能分为历史成本查询、成本优化和未来成本预测三条流程；查询和预测会通过已登录的 Azure CLI 向 Azure Cost Management API 发出 POST 请求。

查看原文
SKILL.md:16来自说明文档打开原文件
| User Intent | Workflow ||-------------|----------|| Understand current costs | [Cost Query](cost-query/workflow.md) || Reduce costs / find waste | [Cost Optimization](cost-optimization/workflow.md) || Project future costs | [Cost Forecast](cost-forecast/workflow.md) |
cost-query/workflow.md:43来自说明文档打开原文件
## Step 5: Construct and Execute the API CallUse `az rest` to call the Cost Management Query API.

优化流程要求 Azure CLI 已登录，并要求目标范围上的 Cost Management Reader、Monitoring Reader 和 Reader 权限。这些权限允许读取费用、监控指标和资源清单，但没有要求写入角色。

查看原文
cost-optimization/workflow.md:7来自说明文档打开原文件
## Step 0: Validate Prerequisites**Required Tools:**- Azure CLI installed and authenticated (`az login`)- Azure CLI extensions: `costmanagement`, `resource-graph`- Azure Quick Review (azqr) installed — See [Azure Quick Review](./azure-quick-review.md)**Required Permissions:**- Cost Management Reader role- Monitoring Reader role- Reader role on subscription/resource group

优化过程会扫描孤立资源、查询最近成本与监控指标，并在本地 output 目录保存包含成本明细、资源建议和实施命令的报告及原始查询结果。

查看原文
cost-optimization/workflow.md:99来自说明文档打开原文件
## Step 2: Run Azure Quick ReviewRun azqr to find orphaned resources (immediate cost savings):**Reference**: [Azure Quick Review](./azure-quick-review.md)```yamlazure__extension_azqr  subscription: "<SUBSCRIPTION_ID>"  resource-group: "<RESOURCE_GROUP>"  # optional```**What to look for:**- Orphaned resources: unattached disks, unused NICs, idle NAT gateways- Over-provisioned resources: excessive retention periods, oversized SKUs- Missing cost tags
cost-optimization/workflow.md:194来自说明文档打开原文件
## Step 7: Generate Optimization ReportGenerate a report to `output/costoptimizereport<YYYYMMDD_HHMMSS>.md` that includes an executive summary, cost breakdown by service, free tier analysis, orphaned resources, prioritized optimization recommendations, and implementation commands. Save cost query results to `output/cost-query-result<YYYYMMDD_HHMMSS>.json` for audit trail, then clean up temporary files.

技能明确要求破坏性操作先获批准、先在非生产环境测试，并提供 dry-run 和回滚步骤；这些是建议执行删除或降级时的重要保护措施。

查看原文
references/tools-and-best-practices.md:43来自说明文档打开原文件
## Safety Requirements- Get approval before deleting resources- Test changes in non-production first- Provide dry-run commands for validation- Include rollback procedures
从这里开始 · 工作说明SKILL.md
azure-cost
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。

文件引用关系图

37 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录23 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • cost-forecast/workflow.md已纳入全文
  • cost-optimization/sdk/azure-resource-manager-redis-dotnet.md已纳入全文
  • cost-optimization/services/redis/azure-cache-for-redis.md已纳入全文
  • cost-optimization/services/storage/azure-storage.md已纳入全文
  • cost-optimization/workflow.md已纳入全文
  • cost-query/workflow.md已纳入全文
  • references/tools-and-best-practices.md已纳入全文
  • cost-forecast/error-handling.md已纳入全文
  • cost-forecast/examples.md已纳入全文
  • cost-forecast/guardrails.md已纳入全文
  • cost-forecast/request-body-schema.md已纳入全文
  • cost-optimization/auth-best-practices.md已纳入全文
  • cost-optimization/azure-aks-anomalies.md已纳入全文
  • cost-optimization/azure-aks-cost-addon.md已纳入全文
  • cost-optimization/azure-quick-review.md已纳入全文
  • cost-optimization/azure-resource-graph.md已纳入全文
  • cost-optimization/report-template.md已纳入全文
  • cost-query/dimensions-by-scope.md已纳入全文
  • cost-query/error-handling.md已纳入全文
  • cost-query/examples.md已纳入全文
  • cost-query/guardrails.md已纳入全文
  • cost-query/request-body-schema.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • cost-forecast/error-handling.md配套文件
  • cost-forecast/examples.md配套文件
  • cost-forecast/guardrails.md配套文件
  • cost-forecast/request-body-schema.md配套文件
  • cost-forecast/workflow.md配套文件
  • cost-optimization/auth-best-practices.md配套文件
  • cost-optimization/azure-aks-anomalies.md配套文件
  • cost-optimization/azure-aks-cost-addon.md配套文件
  • cost-optimization/azure-quick-review.md配套文件
  • cost-optimization/azure-resource-graph.md配套文件
  • cost-optimization/report-template.md配套文件
  • cost-optimization/sdk/azure-resource-manager-redis-dotnet.md配套文件
  • cost-optimization/services/redis/azure-cache-for-redis.md配套文件
  • cost-optimization/services/storage/azure-storage.md配套文件
  • cost-optimization/workflow.md配套文件
  • cost-query/dimensions-by-scope.md配套文件
  • cost-query/error-handling.md配套文件
  • cost-query/examples.md配套文件
  • cost-query/guardrails.md配套文件
  • cost-query/request-body-schema.md配套文件
  • cost-query/workflow.md配套文件
  • references/tools-and-best-practices.md配套文件

代码和说明中提到的操作

连接外部网站
cost-forecast/error-handling.md:13来自说明文档打开原文件
| 429 | Too Many Requests | Rate limited — QPU, entity, or tenant quota exceeded | Check all `x-ms-ratelimit-microsoft.costmanagement-*-retry-after` headers (`qpu`, `entity`, `tenant`). Wait for the **longest** value before retrying. || 503 | Service Unavailable | Temporary service issue | Check [Azure Status](https://status.azure.com) for service health. |
cost-forecast/error-handling.md:46来自说明文档打开原文件
| 424 | ❌ No | Training data issue — retrying will not help. Fall back to actual costs or use **the Cost Query workflow (Part 1)** || 503 | ❌ No | Do not retry. Check [Azure Status](https://status.azure.com) for service health. |
cost-forecast/workflow.md:119来自说明文档打开原文件
| 429 | Rate limited | Check all `x-ms-ratelimit-microsoft.costmanagement-*-retry-after` headers (`qpu`, `entity`, `tenant`). Wait for the **longest** value. **Max 3 retries.** || 503 | Service unavailable | Check [Azure Status](https://status.azure.com). |
运行命令
cost-forecast/workflow.md:77来自说明文档打开原文件
**Execute:**```powershellNew-Item -ItemType Directory -Path "temp" -Force
cost-optimization/auth-best-practices.md:16来自说明文档打开原文件
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
cost-optimization/auth-best-practices.md:81来自说明文档打开原文件
2. **Azure Developer CLI** — `azd auth login`3. **Azure PowerShell** — `Connect-AzAccount`4. **Visual Studio / VS Code** — sign in via Azure extension
读取密钥或账号配置
cost-optimization/auth-best-practices.md:16来自说明文档打开原文件
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
cost-optimization/auth-best-practices.md:32来自说明文档打开原文件
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
cost-optimization/auth-best-practices.md:33来自说明文档打开原文件
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
读取了多少行
2,431
文件校验值（用于核对版本）
a04f205093900294eabd053b13237ce52f698d3d6f38c85049bc31aea7e3b9cc