CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

azure-compliance

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is azure-compliance in microsoft/GitHub-Copilot-for-Azure

SKILL.md
Quality
Evals
Security

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured overview: lean tables, a concrete MCP tool inventory, and excellent progressive disclosure to verified reference files. The main weakness is the workflow, whose steps are sequenced but lack explicit validation checkpoints (e.g., confirming scan output before analyzing findings), and steps do not map to the specific tools or references that execute them.

Suggestions

Add explicit validation checkpoints to the Assessment Workflow, e.g., after step 2: 'Verify scan artifacts were produced before analyzing; if empty or errored, re-check subscription/resource group selection' — this would lift workflow clarity from anchor 3 to 4+.

Map workflow steps to the tools and references that execute them (e.g., step 4 -> keyvault_*_list/get tools and references/azure-keyvault-expiration-audit.md) so each step is directly actionable without guessing.

Drop or merge the Quick Reference table (it duplicates the description, Assessments, and MCP Tools sections) and trim generic Best Practices bullets to reclaim tokens.

DimensionReasoningScore

Conciseness

The body is tight and tabular with no concept explanations Claude already knows, but the Quick Reference table ('Best for | Compliance scans, security audits...') duplicates the description and other sections, and the Best Practices bullets ('Run compliance scans on a regular schedule') are generic. Minor trims are possible, matching anchor 4 rather than the fully lean anchor 5.

4 / 5

Actionability

Concrete MCP tool inventory (e.g., 'mcp_azure_mcp_extension_azqr', 'keyvault_key_get | Get key details including expiration') and concrete error remediation ('Run az login and retry') give mostly executable guidance. Minor gaps: no example tool invocations or parameters, and workflow steps like 'Analyze Scan Results and summarize findings' do not point to which reference file holds the analysis detail.

4 / 5

Workflow Clarity

The five-step Assessment Workflow is a clear, ordered sequence, but validation checkpoints are implicit: there is no step verifying the azqr scan completed or produced artifacts before analysis, and the Error Handling table is recovery-by-error-message rather than an in-sequence checkpoint. This matches anchor 3 ('steps listed but validation gaps, checkpoints missing or implicit'), not 4.

3 / 5

Progressive Disclosure

The body is a clear overview with all assessments routed through well-signaled, one-level-deep reference tables; the SDK quick references form a clean index; and all 12 referenced files exist, with the 3 remaining bundle files (auth-best-practices, azqr-recommendations, azqr-remediation-patterns) reachable one level below their natural parent references. This matches anchor 5 (clear overview, well-signaled references, easy navigation).

5 / 5

Total

16

/

20

Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it pairs concrete capabilities (azqr scans, Key Vault expiration checks) with an explicit WHEN clause containing natural trigger phrases and synonyms. It falls just short of top marks on specificity and trigger coverage because the capability list uses assessment-category nouns and omits a few common phrasings like 'security review'.

DimensionReasoningScore

Specificity

Concrete capabilities are named ('Run Azure compliance and security audits with azqr plus Key Vault expiration checks'), but the follow-on list ('resource review, policy/compliance validation, and security posture checks') names assessment categories rather than anchor-5-level concrete action verbs. It exceeds anchor 3 (only 1-2 concrete actions), so 4 is the best fit.

4 / 5

Completeness

Explicitly answers both questions: 'what' via 'Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review...' and 'when' via the explicit 'WHEN:' clause with concrete trigger phrases. This mirrors the anchor-5 example structure exactly.

5 / 5

Trigger Term Quality

The 'WHEN:' clause covers natural phrases with synonyms ('compliance scan, security audit, Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources'). A few natural phrasings are missing (e.g., 'security review', 'Azure audit', 'certificate expiration'), which matches anchor 4 rather than the comprehensive coverage of anchor 5.

4 / 5

Distinctiveness Conflict Risk

azqr is a niche tool and Key Vault expiration monitoring is a specific task, giving a clear niche with distinct triggers and minimal conflict risk, matching anchor 5. Bare generic terms like 'security audit' appear but are anchored by the Azure/azqr/Key Vault context throughout.

5 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

relative_links

Relative link issues: 9 deeper-than-1-level

Warning

referenced_paths_exist

Referenced path issues: 9 deeper-than-1-level

Warning

Total

14

/

16

Passed

Repository

microsoft/azure-skills

Path

.github/plugins/azure-skills/skills/azure-compliance/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.