deploy-cost-optimized-ai-gateway — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploy-cost-optimized-ai-gateway (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
az account showaz bicep versionaz bicep lint -f infra/main.bicep
az bicep build -f infra/main.bicepVerify resources:
az deployment group create -g $RG -f infra/main.bicep -p infra/parameters.json| Policy | Purpose | APIM Policy Fragment |
|---|---|---|
| Semantic cache lookup | Check Redis before calling OpenAI | <cache-lookup-value> with embedding similarity |
| Semantic cache store | Store response in Redis after OpenAI call | <cache-store-value> with TTL |
| Token budget check | Enforce per-tenant token limits | <rate-limit-by-key> on subscription |
| Model routing | Route to appropriate model by request type | <choose> based on request header/body |
| Load balancing | Distribute across regions | <retry> with multiple backends |
| Rate limiting | Prevent abuse | <rate-limit> per subscription |
<!-- APIM inbound policy for semantic cache -->
<inbound>
<cache-lookup-value key="@(context.Request.Body.As<string>())"
variable-name="cachedResponse" />
<choose>
<when condition="@(context.Variables.ContainsKey("cachedResponse"))">
<return-response>
<set-body>@((string)context.Variables["cachedResponse"])</set-body>
</return-response>
</when>
</choose>
</inbound>| Tier | Monthly Token Budget | Rate Limit | Model Access |
|---|---|---|---|
| Free | 100K tokens | 10 req/min | gpt-4o-mini only |
| Standard | 1M tokens | 60 req/min | gpt-4o-mini + gpt-4o |
| Enterprise | 10M tokens | 300 req/min | All models + priority |
// config/gateway.json
{
"backends": [
{ "region": "eastus2", "endpoint": "https://oai-eastus2.openai.azure.com", "weight": 60, "priority": 1 },
{ "region": "westus3", "endpoint": "https://oai-westus3.openai.azure.com", "weight": 40, "priority": 2 }
],
"failover": { "enabled": true, "retryCount": 2, "retryInterval": "1s" }
}# Test routing
curl -X POST https://$APIM_URL/openai/deployments/gpt-4o/chat/completions \
-H "api-key: $SUB_KEY" -d '{"messages":[{"role":"user","content":"Hello"}]}'
# Test cache hit (repeat same query)
curl -X POST https://$APIM_URL/openai/deployments/gpt-4o/chat/completions \
-H "api-key: $SUB_KEY" -d '{"messages":[{"role":"user","content":"Hello"}]}'
# Should return faster (cache hit)
# Test budget enforcement
python scripts/test_budget.py --sub-key $FREE_KEY --tokens 200000 # Should reject at 100K| Issue | Cause | Fix |
|---|---|---|
| All cache misses | Similarity threshold too high | Lower from 0.99 to 0.95 |
| Wrong model served | Routing policy not matching | Check <choose> conditions in APIM |
| Budget not enforced | Missing rate-limit policy | Add <rate-limit-by-key> to inbound |
| Failover not working | No retry policy | Add <retry> with backend list |
| High latency through APIM | Cache lookup overhead | Optimize Redis connection, use Premium tier |
| 429 errors from OpenAI | TPM quota exceeded | Add more regions or request quota increase |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.