A step that runs echo "Building $(Build.SourceVersionMessage)" looks harmless, but Azure Pipelines pastes the commit message into the script before bash starts, so a commit message with a quote or $( ) in it runs as a command on your agent, next to your secrets. A pipeline still on vmImage: windows-2019 stopped working when that image was removed on 31 December 2025, and CmdLine@1, PowerShell@1, Maven@2 and 70 other task versions are retired on 24 November 2026 and removed on 15 March 2027. This skill finds those and the other Azure Pipelines mistakes below, and tells you how to fix each one.

Your agent runs a scanner on azure-pipelines.yml, files in .azure-pipelines/ and .azuredevops/, and every YAML file whose top-level keys and steps are Azure Pipelines ones, so step, job, stage, variable and extends templates are checked too, including those kept under build/ that a pipeline includes. GitHub Actions, GitLab CI, Compose and Kubernetes files are skipped. It knows macro syntax $(var), template expressions ${{ }} and runtime expressions $[ ], treats values mapped through env: as safe, and follows variables built from untrusted values within a file. It never runs the pipeline or a script and never uses the network. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: passwords, tokens and keys written as literals: variables or env entries with secret names, task inputs such as keystorePass, parameter defaults, passwords in URLs or connection strings, Bearer headers, --token flags, curl -u user:pass, docker/az login -p, sqlcmd -P, PowerShell $password = '...', -Password and ConvertTo-SecureString -AsPlainText, issecret logging commands, and known token formats (ghp_, npm_, glpat-, xox, AWS access key IDs, private key blocks)
• A02: $(Build.SourceVersionMessage) or $(System.PullRequest.SourceBranch), or a variable built from them, inside script text (script, bash, pwsh, powershell, inline task scripts and shell task arguments)
• A03: scripts fetched over plain HTTP or with certificate checks off (curl -k, wget --no-check-certificate, -SkipCertificateCheck) and piped into a shell or Invoke-Expression
• A04: removed images and tasks: retired Microsoft-hosted images (windows-2019, vs2017-win2016, ubuntu-16.04 to ubuntu-20.04, macOS-10.13 to macOS-13, and macOS-14 and ubuntu-22.04 from their removal dates), also through a matrix variable or parameter that vmImage uses, and from 15 March 2027 the retired task versions

REVIEW (check before release)

• A11: checkout with persistCredentials: true
• A12: container jobs or service containers with --privileged, powerful capabilities, host namespaces, seccomp or AppArmor off, a docker.sock volume or mapDockerSocket: true
• A13: templates from GitHub, Bitbucket or another organization's repository resource with no ref or a branch ref (a tag or 40-character commit SHA counts as pinned)
• A14: $(System.AccessToken) or secret-named variables pasted into script text or task command-line arguments instead of env:
• A15: scripts fetched over HTTPS and run straight away (curl | sh, irm | iex, bash <(curl ...), iex "& { $(irm ...) }", [scriptblock]::Create((iwr ...)))
• A16: free-text runtime string parameters without a values list, or $(Build.RequestedFor) and the other requester names, inside script text
• A17: deprecated hosted images before their removal date: macOS-14 (23 November 2026) and ubuntu-22.04 (17 April 2027)
• A18: the 73 task versions on Microsoft's November 2026 retirement list, each shown with its replacement, until their removal on 15 March 2027
• A19: AzureCLI with addSpnToEnvironment: true
• A20: an explicit pr trigger in a pipeline that runs jobs on a self-hosted pool

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and Microsoft source for each rule
• A risky and a safe example (a build and release pipeline with a steps template), and the real report the scanner produces on the risky one

Limits

It reads each YAML file as written. Values passed between files (template parameters, variables from other files, variable groups, UI and queue-time variables) are not followed, and settings made outside YAML are not seen: fork build and fork secret settings, required template checks, queue-time variable limits, shell argument validation, job authorization scope, branch policies and whether the repository is public. Branch names such as $(Build.SourceBranchName) are not flagged. In a whole-repository scan, a build/ folder is searched only for pipeline-named files and local templates, and folders such as dist, vendor and node_modules are skipped. Image and task lists follow Microsoft's pages as of 12 November 2026 for Azure DevOps Services. Classic and release pipelines defined in the web UI are not read. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 12 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (4 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.