fai-key-vault-integrate — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fai-key-vault-integrate (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Eliminate hardcoded secrets by wiring apps to Azure Key Vault with identity-based access.
az webapp identity assign --name app-demo --resource-group rg-demoaz role assignment create --assignee <principalId> --role "Key Vault Secrets User" --scope /subscriptions/<sub>/resourceGroups/rg-demo/providers/Microsoft.KeyVault/vaults/kv-demofrom azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
vault_url = "https://kv-demo.vault.azure.net"
client = SecretClient(vault_url=vault_url, credential=DefaultAzureCredential())
api_key = client.get_secret("openai-api-key").value{
"secret_name": "openai-api-key",
"expires_in_days": 90,
"rotation_alert_days": 14,
"owner": "platform-security"
}| Check | Expected |
|---|---|
| Identity auth | Works without client secret |
| Secret retrieval | Returns expected value |
| Rotation policy | Defined and monitored |
| Access scope | Least privilege role |
| Issue | Cause | Fix |
|---|---|---|
| 403 from Key Vault | Missing RBAC role or propagation delay | Assign role, wait, retry |
| Works locally, fails in Azure | Wrong identity context | Verify managed identity principal id |
| Secret not found | Name/version mismatch | Confirm exact secret name and active version |
# Example verification sequence
npm run lint
npm test
npm run build{
"quality_gate": {
"required": true,
"min_score": 0.8,
"block_on_failure": true
}
}| Control | Requirement |
|---|---|
| Secret handling | No plaintext secrets in repo |
| Access model | Least privilege role assignments |
| Logging | Redact sensitive data before persistence |
| Auditability | Keep immutable trace of critical actions |
| Symptom | Likely Cause | Recommended Action |
|---|---|---|
| Validation gate failures | Threshold too strict or wrong baseline | Recalibrate using a fixed reference dataset |
| Unexpected regressions | Missing scenario coverage | Add targeted regression tests and rerun |
| Production-only issues | Environment mismatch | Diff environment config and identity settings |
| Slow recovery during incidents | Unclear ownership/runbook steps | Add explicit owner and sequence in runbook |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.