azure-compliance

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Quality

78%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Passed

No known issues

Fix and improve this skill with Tessl

tessl review fix ./.github/plugins/azure-skills/skills/azure-compliance/SKILL.md

Quality

Content

57%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-organized with good progressive disclosure and real reference files, but it is held back by redundant trigger sections, a lack of executable examples or tool-invocation syntax, and a workflow missing validation checkpoints for batch scan operations.

Suggestions

Consolidate the overlapping 'Quick Reference', 'When to Use This Skill', and 'Skill Activation Triggers' sections into a single trigger list to remove redundancy and save tokens.

Add at least one concrete example invocation for a key MCP tool (e.g. a sample mcp_azure_mcp_extension_azqr call with scope arguments) so guidance is executable rather than just naming tools.

Insert an explicit validation checkpoint into the Assessment Workflow (e.g. verify the azqr scan completed and produced artifacts before analyzing results) to satisfy the batch-operation feedback-loop expectation.

Dimension	Reasoning	Score
Conciseness	The body is table-driven and free of concept-explanation fluff, but the 'Quick Reference', 'When to Use This Skill', and 'Skill Activation Triggers' sections repeat overlapping triggers (compliance scans, security audits, Key Vault expiration) and could be consolidated. Not a 3 because the redundancy could be tightened; not a 1 because it avoids verbose explanation of things Claude already knows.	2 / 3
Actionability	It names concrete MCP tools (e.g. 'mcp_azure_mcp_extension_azqr', 'keyvault_certificate_get') and links real reference files, but provides no executable example invocations or command syntax — guidance tells what tool to use without showing how to call it. Not a 1 because tool names and references are concrete; not a 3 because nothing is copy-paste ready.	2 / 3
Workflow Clarity	The Assessment Workflow is a clear 5-step sequence, but it lacks explicit validation checkpoints for what are batch operations (whole-subscription/resource-group scans), and the rubric caps workflow_clarity at 2 when validation/verification steps are missing for batch operations. The separate Error Handling table does not substitute for in-workflow checkpoints.	2 / 3
Progressive Disclosure	SKILL.md is a concise overview that signals one-level-deep references (Assessments table, SDK Quick References), every referenced path verified to exist on disk, with content appropriately split across the references/ tree and easy to navigate.	3 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities in third person, provides a comprehensive explicit WHEN trigger list, and occupies a clearly distinct Azure compliance niche. It does not over-claim or pad with fluff.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions in third person — 'Run Azure compliance and security audits', 'Key Vault expiration checks', 'best-practice assessment, resource review, policy/compliance validation, and security posture checks' — matching the anchor for enumerating specific actions rather than vague language.	3 / 3
Completeness	Explicitly answers both what ('Run Azure compliance and security audits with azqr plus Key Vault expiration checks') and when (the explicit 'WHEN:' trigger list), satisfying the anchor for clearly answering both with explicit triggers.	3 / 3
Trigger Term Quality	The WHEN clause covers natural phrasings a user would actually say — 'compliance scan', 'security audit', 'expired certificates', 'expiring secrets', 'orphaned resources', 'Azure best practices' — giving good coverage of common variations rather than jargon.	3 / 3
Distinctiveness Conflict Risk	The Azure compliance / Key Vault expiration niche with azqr-specific and Key Vault-specific triggers is clearly distinguishable from other skills and unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 9 deeper-than-1-level	Warning
referenced_paths_exist	Referenced path issues: 9 deeper-than-1-level	Warning

	Total	14 / 16 Passed

Repository: microsoft/azure-skills
Commit: 39464cb

Reviewed: about 5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.