Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alexpizarro/azure-lean-stack-skills --skill diagnosing-azure-deployment-failuresgit clone --depth 1 https://github.com/alexpizarro/azure-lean-stack-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures)<a href="https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures"><img src="https://agentmods.dev/badge/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures"><img src="https://agentmods.dev/badge/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.01809 |
| Opus 5 | $0.00049 | $0.00905 |
| Sonnet 5 | $0.00020 | $0.00362 |
| Haiku 4.5 | $0.00010 | $0.00181 |
Grade B, and why
diagnosing-azure-deployment-failures scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `gpg: cannot open /dev/tty` | `gpg --dearmor` without `--batch` in CI | Use `gpg --batch --yes --dearmor \| sudo tee` | How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Diagnosing Azure Deployment Failures
Lookup-first triage against documented gotchas. If the symptom doesn't match a known entry, escalate to Microsoft's azure-diagnostics for live log/metric queries.
How to use this skill
- Get the failing symptom (error code, stack trace, observed behaviour)
- Match against the table below
- Apply the documented fix
- If no match, see references/gotchas.md for the full catalogue
- If still no match, capture a new gotcha via curating-azure-deployment-learnings
Quick symptom table
| Symptom | Likely cause | Fix |
|---|---|---|
BCP258: sqlAdminPassword missing |
Using .bicepparam instead of .parameters.json |
Keep params as .parameters.json; use @ prefix |
LocationNotAvailableForResourceType for SWA |
australiaeast not supported |
Hard-code swaLocation = 'eastasia' |
Multiple files found matching pattern *.sql |
azure/sql-action accepts only one file |
Replace with sqlcmd bash loop |
sqlcmd: command not found (exit 127) |
Not pre-installed on ubuntu-24.04 | Install mssql-tools18 via Microsoft apt repo |
gpg: cannot open /dev/tty |
gpg --dearmor without --batch in CI |
Use gpg --batch --yes --dearmor | sudo tee |
OIDC fails AADSTS70021 |
Federated credential subject mismatch | Must match repo:owner/repo:ref:refs/heads/branch exactly |
AZURE_CREDENTIALS auth fails silently |
WARNING: text prepended to SP JSON |
Strip with 2>/dev/null | python3 pipeline |
| Bicep runs on every push (slow) | No change detection | Add git diff check, conditional steps |
error TS7016: no declaration for 'mssql' |
@types/mssql missing |
Add "@types/mssql": "^9.1.5" |
| New function returns 404 after deploy | Not imported in api/src/index.ts |
Add import './functions/{name}' |
| Functions return 500 on first request | SQL serverless auto-paused | Wait 30–60s, retry |
| Placeholder strings cause cryptic errors | Non-empty placeholders fool if (!value) |
Use "" in example files |
az functionapp create creates wrong plan |
CLI silently falls back to Y1/Dynamic | Use ARM REST API or Bicep for FC1 |
az appservice plan create --sku FC1 fails |
CLI doesn't support FC1 reliably | Use ARM REST API |
| ARM PUT doesn't change hosting plan | Can't migrate existing app | Delete and recreate |
FUNCTIONS_WORKER_RUNTIME causes failure |
Forbidden on FC1 | Remove from app settings |
az functionapp cors add returns Bad Request |
CLI CORS broken on FC1 | Use ARM REST API |
"main": "dist/functions/*.js" doesn't work |
Glob not resolved | Use "main": "dist/index.js" |
Missing package-lock.json breaks CI |
cache-dependency-path points to missing file |
Commit lock file |
| Publish profile auth 401 on FC1 | Kudu auth different on FC1 | Use SP auth with azure/login@v2 |
| Cold start 15-30s on ACA | Large Docker image | Use Alpine, prune devDeps |
| SSE connections drop after 4 min | Default 240s request timeout | --request-timeout 1800 |
az containerapp update has no effect |
Unchanged secret values skip restart | az containerapp revision restart |
| Secrets not available in app | Env var not linked | --set-env-vars "VAR=secretref:secret-name" |
| Docker Hub image not pulled | Rate limit (100/6h anonymous) | Authenticated pulls or move to GHCR/ACR |
DeploymentModelNotSupported (Azure OpenAI) |
Model version not available in region | Verify: az cognitiveservices model list --location ... |
EMAIL_FROM unknown before first deploy |
Azure-managed domain hash auto-generated | Retrieve post-deploy with az communication email domain show |
| Email send crashes HTTP handler | pollUntilDone() throws |
Use safeSend() wrapper |
| ACS resources fail with location error | Microsoft.Communication/* requires location: 'global' |
Hardcode location: 'global' |
ACS dataLocation fails |
Uses plain English, not region IDs | dataLocation: 'Australia' |
| ACS circular dependency | linkedDomains + dependsOn conflict |
Declare order: emailService → domain → acs |
403 on roleAssignments |
OIDC SP only has Contributor | Grant User Access Administrator at RG scope |
listSecrets output warning |
Bicep linter flags secrets in outputs | #disable-next-line outputs-should-not-contain-secrets |
| SWA self-referencing URL needed | APP_BASE_URL unknown before first deploy |
Use 'https://${swa.properties.defaultHostname}' |
| Can't test before Azure provisioned | No mock pattern | Check if (!process.env.KEY) → return mock |
local.settings.json placeholder strings |
Fake strings are truthy | Use "" for all user-input values |
| SQL Serverless bill higher than expected; DB never pauses | Health endpoint or scheduler polls the DB, keeping it awake 24/7 | DB-free shallow health check; or switch to flat Basic tier (~$5/mo). See cost-guardrails Guardrail #11 |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 92 lines · 99 tokens per session scan B e3d0334da94c
diagnosing-azure-deployment-failures is a skill published in the GitHub repository alexpizarro/azure-lean-stack-skills (1 stars, last pushed 1mo ago), licensed MIT. It adds 99 tokens to every session and 1,809 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
azure-kubernetes-automatic-readiness
Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic…
azure-diagnostics
Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, troubleshoot functions, troubleshoot AKS, VM RDP, Linux SSH, VM black…
atmos-lint
Atmos Terraform linting with TFLint: standalone atmos terraform lint, component-aware config discovery and toolchain versions, TFLint rule configuration, and lifecycle hooks/CI findings. Use when configuring, running, debugging, or documenting Terraform/OpenTofu linting in an Atmos project.
azure-expert
Expert-level Microsoft Azure cloud platform, services, and architecture. Use when the user mentions cloud, Microsoft platforms, Azure Functions, or Cosmos DB.
datadog-ninja
Master orchestrator for 57 official Datadog agent skills from DataDog/pup and datadog-labs/agent-skills. Use when working with ANY Datadog observability task: APM and distributed tracing, log search and pipelines, monitors and alerting, live production debugging, audit trail investigations, browser SDK…
iac-common
UTILITY SKILL — Shared IaC deploy patterns for Bicep + Terraform agents: deployment strategies, circuit breaker, known deploy issues. WHEN: "phased deployment", "circuit breaker", "deploy strategy", "deploy issue", "shared IaC pattern". DO NOT USE FOR: preflight (azure-validate), code generation (azure-bicep-patterns…