agentsclimarketplace

Detecting azure storage account misconfigurations

Skill autohandai/community-skills/detecting-azure-storage-account-misconfigurations

A collection of curated, useful, and safe skills for Autohand Code CLI Agent

Install
npx -y skills add autohandai/community-skills --skill detecting-azure-storage-account-misconfigurations

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 9 stars9 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit Azure Blob and ADLS storage accounts for public access exposure, weak or long-lived SAS tokens, missing encryption at rest, disabled HTTPS-only traffic, and outdated TLS versions using the azure-mgmt-storage Python SDK.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.1 KB, 334 tokens by cl100k_base, as published. Nobody here has run it

Detecting Azure Storage Account Misconfigurations

Overview

Azure Storage accounts are a frequent target for attackers due to misconfigured public access, long-lived SAS tokens, missing encryption, and outdated TLS versions. This skill uses the azure-mgmt-storage Python SDK with StorageManagementClient to enumerate all storage accounts in a subscription, inspect their security properties, list blob containers for public access settings, and generate a risk-scored audit report identifying critical misconfigurations.

Prerequisites

  • Python 3.9+ with azure-mgmt-storage, azure-identity
  • Azure service principal with Reader role on target subscription
  • Environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID

Key Detection Areas

  1. Public blob access — allow_blob_public_access enabled on storage account or individual containers set to Blob/Container access level
  2. HTTPS enforcement — enable_https_traffic_only disabled, allowing unencrypted HTTP traffic
  3. Minimum TLS version — accounts accepting TLS 1.0 or TLS 1.1 instead of minimum TLS 1.2
  4. Encryption at rest — storage service encryption not enabled or missing customer-managed keys
  5. Network rules — default action set to Allow instead of Deny, exposing storage to all networks
  6. SAS token risks — account-level SAS with overly broad permissions or excessive lifetime

Output

JSON report with per-account findings, severity ratings (Critical/High/Medium/Low), and remediation recommendations aligned with CIS Azure Benchmark controls.

What ships with it: 3 files

23.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 326,970. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.