audit: microsoft/skills (94/100, security:BLOCKED, progressive, 226 artifacts)

auditor/disclosures-pending/microsoft-skills.md

@@ -0,0 +1,31 @@
+<!--
+Auto-prepared disclosure body for microsoft/skills.
+The audit workflow's GITHUB_TOKEN cannot file issues on third-party
+repos, so this body sits here pending manual filing:
+
+  gh issue create --repo microsoft/skills \
+    --title 'Security findings in executable artifacts' \
+    --body-file auditor/disclosures-pending/microsoft-skills.md
+
+After filing, record the URL with:
+  jq '.repos["microsoft/skills"] += {disclosure_url: "<URL>", disclosure_filed_at: "<ISO8601>", disclosure_filed_by: "manual"}' \
+    auditor/registry/repos.json > /tmp/r.json && mv /tmp/r.json auditor/registry/repos.json
+-->
+
+## Security Findings in Executable Artifacts
+
+While auditing NL programming artifacts in this repository, our scanner detected potential security issues in executable files.
+
+### Findings
+
+| # | Severity | File | Line | Pattern | Description |
+|---|----------|------|------|---------|-------------|
+| 1 | Critical | .github/plugins/azure-skills/skills/python-appservice-deploy/scripts/retry-az-create.sh | 36 | `eval "$VAR ..."` | `eval` executes caller-supplied `$SHOW_CMD`/`$CREATE_CMD` strings, passed in as `$1`/`$2` and documented as "single shell-quoted strings." Generic az-CLI retry wrapper by design, but any unsanitized data reaching these positional args gets full shell execution, not just an `az` invocation. |
+
+### About This Report
+
+These findings come from [NLPM](https://github.com/xiaolai/nlpm)'s security scanner, which checks executable surfaces (hooks, scripts, MCP configs, dependencies) against known-dangerous patterns.
+
+We may be wrong — false positives happen. If any finding is intentional or already mitigated, please close this issue. If a finding is genuine and you'd like a fix PR, let us know.
+
+Full audit report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/microsoft-skills.md

auditor/logs/events.jsonl

@@ -3761,9 +3761,14 @@
 {"timestamp":"2026-08-05T02:07:56Z","workflow":"discover","event":"search_complete","run_id":"30968348211","run_number":39,"data":{"candidates":161,"new":57,"worthy":6,"oversized":18}}
 {"timestamp":"2026-08-05T04:36:41Z","workflow":"classify","event":"classifications_emitted","run_id":"30975581065","run_number":107,"data":{"classifications":0,"invalid":0,"no_dissent":true}}
 {"timestamp":"2026-08-05T05:14:52Z","workflow":"track","event":"status_check","run_id":"30977076136","run_number":653,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}}
+{"timestamp":"2026-08-05T07:18:46Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","sidecar":"auditor/audits/microsoft-skills.findings.jsonl","drifts":0,"exit_code":0,"total_findings":111,"missing_confidence":0}}
+{"timestamp":"2026-08-05T07:18:49Z","workflow":"audit","event":"findings_aggregated","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","findings":111,"invalid_lines":0,"self_false_positives":0}}
+{"timestamp":"2026-08-05T07:18:49Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","html":"auditor/reports/microsoft-skills.html"}}
+{"timestamp":"2026-08-05T07:18:50Z","workflow":"audit","event":"audit_complete","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","score":94,"artifacts":226,"strategy":"progressive"}}
 {"timestamp":"2026-08-05T07:03:41Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","sidecar":"auditor/audits/Shubhamsaboo-awesome-llm-apps.findings.jsonl","drifts":0,"exit_code":0,"total_findings":23,"missing_confidence":0}}
 {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"findings_aggregated","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","findings":23,"invalid_lines":0,"self_false_positives":0}}
 {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","html":"auditor/reports/Shubhamsaboo-awesome-llm-apps.html"}}
 {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"audit_complete","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","score":96,"artifacts":11,"strategy":"single"}}
 {"timestamp":"2026-08-05T07:03:59Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","queue_path":"auditor/disclosures-pending/Shubhamsaboo-awesome-llm-apps.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}}
+{"timestamp":"2026-08-05T07:20:34Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983052751","run_number":748,"data":{"repo":"microsoft/skills","queue_path":"auditor/disclosures-pending/microsoft-skills.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}}
 {"timestamp":"2026-08-05T09:09:12Z","workflow":"track","event":"status_check","run_id":"30991292365","run_number":654,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}}

auditor/registry/repos.json

@@ -9756,10 +9756,13 @@
       "stars": 2861,
       "artifacts": 226,
       "description": "Skills, MCP servers, Custom Agents, Agents.md for SDKs to ground Coding Agents",
-      "status": "discovered",
-      "score": null,
+      "status": "audited",
+      "score": 94,
       "audit_issue": 761,
-      "prs": []
+      "prs": [],
+      "strategy": "progressive",
+      "security": "BLOCKED",
+      "commit_sha_at_audit": "1f28ae4c5e5edc2cbe10b3756a20524fc92cee07"
     },
     "phuryn/pm-skills": {
       "discovered": "2026-08-05T02:07:37Z",