·
Last changedVersion:
This version passed the hardening gate. Hardening applied 27 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 0. Classified findings remaining: 2. Unclassified scanner findings remaining: 0. Review findings closed: 10. Review findings remaining: 2.
2
2
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
references/preset-workflow.md | Malicious Code & Command Execution | Command injection | Low | Open | |
references/workflow.md | Malicious Code & Command Execution | Command injection | Low | Open |
2 findings
Automates intelligent Azure OpenAI model deployment by checking capacity across regions and deploying to the best available option.
PROJECT_RESOURCE_ID env var or provided interactively)
/subscriptions/{sub-id}/resourceGroups/{rg}/providers/Microsoft.CognitiveServices/accounts/{account}/projects/{project}This skill needs only three things. It reads the bundled reference files. It runs the az commands shown in the workflow. It runs the bundled deployment name script after reading it. It keeps capacity data in memory, leaves skill and user files as they are, and runs no other shell commands or web requests.
Approval gate: Before any account create or deployment create, show the user the subscription, resource group, region, model, version, SKU and capacity. Note that these resources are billable. Proceed only after the user explicitly approves. Cost can be checked with the separate cost estimation skill.
Input checks: Take model name, version and region only from values returned by the list-models and capacity queries. Accept only letters, digits, hyphens and periods in model name, version, region and deployment name. Keep every value double-quoted in commands, and stop if a value contains anything else.
Capacity: Show the computed capacity and its effect on remaining quota, and let the user adjust it before deploying.
Bundled scripts: Before running any bundled script, read it and confirm that it only lists deployments or builds a portal link. If it does anything else, or is missing, stop and choose the deployment name by hand using the numeric suffix rule.
| Phase | Action | Key Commands |
|---|---|---|
1. Verify Auth | Check Azure CLI login and subscription |
|
2. Get Project | Parse |
|
3. Get Model | List available models, user selects model + version |
|
4. Check Current Region | Query capacity using GlobalStandard SKU |
|
5. Multi-Region Query | If no local capacity, query all regions | Same capacity API without location filter |
6. Select Region + Project | User picks region; find or create project |
|
7. Deploy | Generate unique name, calculate capacity (50% available, min 50 TPM), create deployment |
|
For detailed step-by-step instructions, see workflow reference.
| Error | Symptom | Resolution |
|---|---|---|
Auth failure |
| Ask the user to run |
No quota | All regions show 0 capacity | Defer to the quota skill for increase requests and troubleshooting; check existing deployments; try alternative models |
Model not found | Empty capacity list | Verify model name with |
Name conflict | "deployment already exists" | Append suffix to deployment name (handled automatically by |
Region unavailable | Region doesn't support model | Select a different region from the available list |
Permission denied | "Forbidden" or "Unauthorized" | Verify Cognitive Services Contributor role: |
azure-cost pluginGet started with chainctlchainctl skill install public/microsoft/preset:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/microsoft/skills/microsoft-foundry/models/deploy-model/preset:latest
MIT
EXAMPLES.md
HARDENING.md
LICENSE
SKILL.md
references/preset-workflow.md
references/workflow.md