跳转到正文
报告库
用途分类 / 数据分析

Azure Storage Skill 安全审计

作者说它能做什么(原文)

Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. Answers questions about storage access tiers (hot, cool, cold, archive), when to use each tier, and tier comparison. Provides object storage, SMB file shares, async messaging, NoSQL key-value, and big data analytics. Includes lifecycle management. USE FOR: blob storage, file shares, queue stora

第三方安全检查结论

发现安全风险

已检查文件
14
发现的风险
2
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。未发现风险
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。发现 1 项风险
中风险

上传示例会明确覆盖同名远程 Blob

原文依据:3 处
发现了什么

多个快速入门示例把覆盖选项设为 true。若目标容器中已存在同名 Blob,运行这些示例会用示例数据替换其内容。

为什么需要注意

用户可能丢失或破坏 Azure 中的现有数据;能否恢复取决于账户是否启用了版本控制、软删除或备份。

这是示例代码,不会仅因安装 Skill 而执行;但若用户复制运行并把占位符替换为真实账户,Python 和 C# 示例都明确允许覆盖。目标容器中若已有同名 Blob,其内容会被示例数据替换。运行前应确认账户、容器和 Blob 名称,并要求仅在明确授权覆盖时启用该选项。

references/sdk-usage.md:36来自说明文档打开原文件
service = BlobServiceClient(account_url="https://ACCOUNT.blob.core.windows.net/", credential=DefaultAzureCredential())container = service.get_container_client("my-container")blob = container.get_blob_client("my-blob.txt")blob.upload_blob(b"Hello, Azure Storage!", overwrite=True)```
查看另外 2 个位置
references/sdk-usage.md:58来自说明文档打开原文件
var client = new BlobServiceClient(new Uri("https://ACCOUNT.blob.core.windows.net/"), new DefaultAzureCredential());var container = client.GetBlobContainerClient("my-container");var blob = container.GetBlobClient("my-blob.txt");await blob.UploadAsync(BinaryData.FromString("Hello, Azure Storage!"), overwrite: true);```
references/sdk-usage.md:74来自说明文档打开原文件
    .buildClient();BlobContainerClient container = client.getBlobContainerClient("my-container");BlobClient blob = container.getBlobClient("my-blob.txt");blob.upload(BinaryData.fromString("Hello, Azure Storage!"), true);```
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。发现 1 项风险
中风险

本地示例会自动采用用户现有的 Azure 登录身份

原文依据:5 处
发现了什么

示例使用 DefaultAzureCredential;指南说明它会从 Azure CLI、PowerShell、VS Code 等开发工具自动取得凭据。运行代码时可能无需再次登录或确认目标租户。

为什么需要注意

如果缓存身份权限较广,示例或代理可用该用户权限读取、上传或覆盖云端数据;选错订阅、租户、账户或容器会扩大误操作范围。

风险有条件成立:这些是本地开发示例,并且文档明确警告不要在生产环境使用 DefaultAzureCredential。用户实际运行时,它会尝试采用 Azure CLI、PowerShell、VS Code 等已有登录身份;上传示例随后可用该身份访问所填账户,代码中没有单独的租户或写入确认。运行前应核对当前 Azure 身份、租户、订阅和目标账户,并限制该身份的 RBAC 权限。

references/auth-best-practices.md:77来自说明文档打开原文件
`DefaultAzureCredential` is ideal for local dev because it automatically picks up credentials from developer tools:1. **Azure CLI** — `az login`2. **Azure Developer CLI** — `azd auth login`3. **Azure PowerShell** — `Connect-AzAccount`4. **Visual Studio / VS Code** — sign in via Azure extension
查看另外 4 个位置
references/auth-best-practices.md:20来自说明文档打开原文件
1. **Unpredictable fallback chain** — walks through multiple credential types, adding latency and making failures harder to diagnose.2. **Broad surface area** — checks environment variables, CLI tokens, and other sources that should not exist in production.3. **Non-deterministic** — which credential actually authenticates depends on the environment, making behavior inconsistent across deployments.4. **Performance** — each failed credential attempt adds network round-trips before falling back to the next.
references/sdk-usage.md:29来自说明文档打开原文件
All examples use `DefaultAzureCredential` for authentication, which is recommended for **local development only**. In production, use `ManagedIdentityCredential` — see [auth-best-practices.md](auth-best-practices.md). Rust uses `DeveloperToolsCredential` as it doesn't have a `DefaultAzureCredential` equivalent.
references/auth-best-practices.md:7来自说明文档打开原文件
Use **managed identities** and **Azure RBAC** in production. Reserve `DefaultAzureCredential` for **local development only**.
references/sdk-usage.md:36来自说明文档打开原文件
service = BlobServiceClient(account_url="https://ACCOUNT.blob.core.windows.net/", credential=DefaultAzureCredential())container = service.get_container_client("my-container")blob = container.get_blob_client("my-blob.txt")blob.upload_blob(b"Hello, Azure Storage!", overwrite=True)```
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 的核心用途是操作 Azure Storage:首选通过 Azure MCP 列出账户、容器和 Blob,并可下载或上传 Blob。

查看原文
SKILL.md:26来自说明文档打开原文件
- `azure__storage` with command `storage_account_list` - List storage accounts- `azure__storage` with command `storage_container_list` - List containers in account- `azure__storage` with command `storage_blob_list` - List blobs in container- `azure__storage` with command `storage_blob_get` - Download blob content- `azure__storage` with command `storage_blob_put` - Upload blob content

未启用 MCP 时,该 Skill 提供 Azure CLI 命令作为后备方案,包括下载到本地路径和从本地路径上传。

查看原文
SKILL.md:46来自说明文档打开原文件
# Download blobaz storage blob download --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH# Upload blobaz storage blob upload --account-name ACCOUNT --container-name CONTAINER --name BLOB --file LOCAL_PATH```

参考资料要求安装 Azure SDK 和身份包;这些安装命令会更改用户项目的依赖环境。

查看原文
references/sdk-usage.md:20来自说明文档打开原文件
|----------|-----------------------------|| .NET | `dotnet add package Azure.Storage.Blobs` `dotnet add package Azure.Identity` || Java | Maven: `com.azure:azure-storage-blob` `com.azure:azure-identity` || JavaScript | `npm install @azure/storage-blob @azure/identity` || Python | `pip install azure-storage-blob azure-identity` || Go | `go get github.com/Azure/azure-sdk-for-go/sdk/storage/azblob github.com/Azure/azure-sdk-for-go/sdk/azidentity` || Rust | `cargo add azure_storage_blob azure_identity` |

身份验证指南明确区分本地开发和生产环境,并建议生产环境使用托管身份和最小权限 RBAC;这降低了但不能消除示例使用现有登录身份的风险。

查看原文
references/auth-best-practices.md:7来自说明文档打开原文件
Use **managed identities** and **Azure RBAC** in production. Reserve `DefaultAzureCredential` for **local development only**.
references/auth-best-practices.md:112来自说明文档打开原文件
- [ ] Use managed identity for all Azure-hosted apps- [ ] Never hardcode credentials, connection strings, or keys- [ ] Apply least-privilege RBAC roles at the narrowest scope- [ ] Use `ManagedIdentityCredential` (not `DefaultAzureCredential`) in production- [ ] Store any required secrets in Azure Key Vault- [ ] Rotate secrets and certificates on a schedule
从这里开始 · 工作说明SKILL.md
azure-storage
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。 另有 1 个章节,可在原文件中查看。

文件引用关系图

23 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用,不是运行顺序。点击节点可高亮相关连线,并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录14 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/sdk-usage.md已纳入全文
  • references/sdk/azure-data-tables-java.md已纳入全文
  • references/sdk/azure-data-tables-py.md已纳入全文
  • references/sdk/azure-storage-blob-java.md已纳入全文
  • references/sdk/azure-storage-blob-py.md已纳入全文
  • references/sdk/azure-storage-blob-rust.md已纳入全文
  • references/sdk/azure-storage-blob-ts.md已纳入全文
  • references/sdk/azure-storage-file-datalake-py.md已纳入全文
  • references/sdk/azure-storage-file-share-py.md已纳入全文
  • references/sdk/azure-storage-file-share-ts.md已纳入全文
  • references/sdk/azure-storage-queue-py.md已纳入全文
  • references/sdk/azure-storage-queue-ts.md已纳入全文
  • references/auth-best-practices.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明
  • references/auth-best-practices.md配套文件
  • references/sdk-usage.md配套文件
  • references/sdk/azure-data-tables-java.md配套文件
  • references/sdk/azure-data-tables-py.md配套文件
  • references/sdk/azure-storage-blob-java.md配套文件
  • references/sdk/azure-storage-blob-py.md配套文件
  • references/sdk/azure-storage-blob-rust.md配套文件
  • references/sdk/azure-storage-blob-ts.md配套文件
  • references/sdk/azure-storage-file-datalake-py.md配套文件
  • references/sdk/azure-storage-file-share-py.md配套文件
  • references/sdk/azure-storage-file-share-ts.md配套文件
  • references/sdk/azure-storage-queue-py.md配套文件
  • references/sdk/azure-storage-queue-ts.md配套文件

代码和说明中提到的操作

运行命令
SKILL.md:36来自说明文档打开原文件
```bash# List storage accounts
references/auth-best-practices.md:16来自说明文档打开原文件
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
references/auth-best-practices.md:81来自说明文档打开原文件
2. **Azure Developer CLI** — `azd auth login`3. **Azure PowerShell** — `Connect-AzAccount`4. **Visual Studio / VS Code** — sign in via Azure extension
连接外部网站
SKILL.md:82来自说明文档打开原文件
- Blob storage patterns and lifecycle -> [Blob Storage documentation](https://learn.microsoft.com/azure/storage/blobs/storage-blobs-overview)- File shares and Azure File Sync -> [Azure Files documentation](https://learn.microsoft.com/azure/storage/files/storage-files-introduction)
SKILL.md:83来自说明文档打开原文件
- Blob storage patterns and lifecycle -> [Blob Storage documentation](https://learn.microsoft.com/azure/storage/blobs/storage-blobs-overview)- File shares and Azure File Sync -> [Azure Files documentation](https://learn.microsoft.com/azure/storage/files/storage-files-introduction)- Queue patterns and poison handling -> [Queue Storage documentation](https://learn.microsoft.com/azure/storage/queues/storage-queues-introduction)
SKILL.md:84来自说明文档打开原文件
- File shares and Azure File Sync -> [Azure Files documentation](https://learn.microsoft.com/azure/storage/files/storage-files-introduction)- Queue patterns and poison handling -> [Queue Storage documentation](https://learn.microsoft.com/azure/storage/queues/storage-queues-introduction)
读取密钥或账号配置
references/auth-best-practices.md:16来自说明文档打开原文件
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
references/auth-best-practices.md:32来自说明文档打开原文件
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
references/auth-best-practices.md:33来自说明文档打开原文件
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
安装其他软件包
references/sdk-usage.md:22来自说明文档打开原文件
| Java | Maven: `com.azure:azure-storage-blob` `com.azure:azure-identity` || JavaScript | `npm install @azure/storage-blob @azure/identity` || Python | `pip install azure-storage-blob azure-identity` |
references/sdk-usage.md:23来自说明文档打开原文件
| JavaScript | `npm install @azure/storage-blob @azure/identity` || Python | `pip install azure-storage-blob azure-identity` || Go | `go get github.com/Azure/azure-sdk-for-go/sdk/storage/azblob github.com/Azure/azure-sdk-for-go/sdk/azidentity` |
references/sdk/azure-data-tables-py.md:8来自说明文档打开原文件
## Installpip install azure-data-tables azure-identity
读取了多少行
675
文件校验值(用于核对版本)
cac11802becf9138fc18858c282bc566fdbf2b3599b56464019adab320d07138