allowBlobPublicAccess: true on one storage account, or one network security group rule with sourceAddressPrefix: '*' on port 22, is enough to leak every file or hand a VM to the bots that scan Azure address ranges. This skill finds those and eleven other Azure template mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your .bicep files, .bicepparam files, ARM JSON templates (including az bicep build output and nested templates) and *.parameters.json files. It parses Bicep itself (comments, ${...} strings, decorators, if conditions, for loops, existing and nested child resources), finds each resource by its type, follows parameters and variables to their literal values, and reports each finding at the property's line. It never calls Azure, runs bicep or deploys anything. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: storage accounts and blob containers open to anonymous access

• A02: SSH, RDP, database or all ports open to *, Internet or 0.0.0.0/0 in network security groups

• A03: passwords and keys in @secure() defaults, properties, app settings, parameter files and AccountKey= connection strings

• A04: listKeys() results and secure parameters returned as outputs

• A05: SQL, PostgreSQL and MySQL firewall rules open to every address

REVIEW (check before release)

• A11: TLS 1.0 and 1.1 allowed

• A12: HTTPS-only off, the non-TLS Redis port and require_secure_transport off

• A13: firewall rules open to all of Azure (Allow Azure services)

• A14: Key Vaults without purge protection

• A15: publicNetworkAccess Enabled on data services

• A16: plain FTP allowed on App Service and Function apps

• A17: secret parameters not marked @secure()

• A18: other ports open to the internet

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads your files as written. Values passed in at deploy time, registry modules (br:) and template specs, conditions, Azure Policy and subscription settings, and properties built with functions such as union() are not evaluated. Data services that leave public network access at the Azure default are not reported. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 15 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.