azure-compliance

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

Quality

74%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./.github/plugins/azure-skills/skills/azure-compliance/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured overview with concrete tool inventories, error/priority tables, and clean progressive disclosure to reference files. Its main weaknesses are the absence of validation/feedback loops in a batch-audit workflow (capping workflow clarity) and a lack of example tool invocations, plus minor redundancy between the two 'when to use' sections.

Suggestions

Add explicit validation/verification checkpoints to the Assessment Workflow — e.g. 'Verify azqr produced a non-empty Excel output before analyzing', and 'Confirm keyvault_*_list returned results before calling *_get' — to lift workflow_clarity past the batch-operation cap of 3.

Include at least one concrete example tool invocation with parameters (e.g. a sample mcp_azure_mcp_extension_azqr call and a keyvault_secret_get call showing how expiration is read) so the body is executable, not just descriptive.

Merge the redundant 'When to Use This Skill' and 'Skill Activation Triggers' sections into a single list to remove duplicated triggers and tighten conciseness.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean tables and bullets with no padding about concepts Claude already knows, but 'When to Use This Skill' and 'Skill Activation Triggers' substantially overlap (both enumerate the same use cases), which is trimming-worthy redundancy rather than a 5-anchored fully lean doc.	4 / 5
Actionability	The MCP Tools table gives concrete tool names and the Error Handling table maps specific messages to fixes, but the body contains no example tool invocations or parameters and the workflow steps are high-level ('Run azqr and capture output artifacts', 'Analyze Scan Results and summarize findings'), deferring executable detail to references — matching the 3 anchor for concrete-but-incomplete guidance.	3 / 5
Workflow Clarity	A 5-step Assessment Workflow with a clear sequence and supporting Priority/Error tables exists, but there are no validation checkpoints or feedback loops, and the batch operations (whole-subscription scans, enumerating all keys/secrets/certs) trigger the rubric's cap at 3 for batch skills missing verification steps.	3 / 5
Progressive Disclosure	SKILL.md is a clear overview with well-signaled reference tables (Assessments and SDK Quick References), but references are not strictly one level deep — azure-quick-review.md links onward to azqr-recommendations.md and azqr-remediation-patterns.md, and SDK files link to ../auth-best-practices.md — a minor organization gap that keeps it at the 4 anchor rather than 5.	4 / 5
	Total	14 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-targeted description that clearly states capabilities and provides an explicit WHEN trigger list with natural user phrasing. It is highly distinctive and complete; only minor synonym gaps and a couple of generic action terms keep specificity and trigger quality just below the top anchor.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions — 'Run Azure compliance and security audits with azqr', 'Key Vault expiration checks', 'best-practice assessment, resource review, policy/compliance validation, and security posture checks' — but terms like 'resource review' and 'policy/compliance validation' stay somewhat generic, so it sits just below the comprehensive 5 anchor.	4 / 5
Completeness	It explicitly answers both what ('Run Azure compliance and security audits... Covers best-practice assessment, resource review...') and when via a concrete WHEN clause with multiple trigger phrases, matching the 5 anchor that requires explicit what-and-when with concrete triggers.	5 / 5
Trigger Term Quality	The WHEN clause surfaces natural phrases users would actually say — 'compliance scan', 'security audit', 'Key Vault expiration check', 'expired certificates', 'expiring secrets', 'orphaned resources' — with good synonym coverage, though a few natural variants (e.g. 'expiring keys', 'key rotation') are missing, keeping it below the 5 anchor.	4 / 5
Distinctiveness Conflict Risk	The niche is sharply defined by distinctive triggers — 'BEFORE running azqr (compliance cli tool)', 'Key Vault expiration check', 'expired certificates' — giving it a clear lane with minimal overlap risk against other skills, matching the 5 anchor.	5 / 5
	Total	18 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
relative_links	Relative link issues: 9 deeper-than-1-level	Warning
referenced_paths_exist	Referenced path issues: 9 deeper-than-1-level	Warning

	Total	14 / 16 Passed

Repository: microsoft/azure-skills
Path: .github/plugins/azure-skills/skills/azure-compliance/SKILL.md
Commit: 16dc8c5

Reviewed: about 12 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.