Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add alexpizarro/azure-lean-stack-skills --skill diagnosing-azure-deployment-failuresgit clone --depth 1 https://github.com/alexpizarro/azure-lean-stack-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures)<a href="https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures"><img src="https://agentmods.dev/badge/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures"><img src="https://agentmods.dev/badge/skills/alexpizarro/azure-lean-stack-skills/diagnosing-azure-deployment-failures.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00126 | $0.02465 |
| Opus 5.5 | $0.00050 | $0.00986 |
| Sonnet 5.5 | $0.00025 | $0.00493 |
| Haiku 4.5 | $0.00013 | $0.00247 |
Grade B, and why
diagnosing-azure-deployment-failures scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `gpg: cannot open /dev/tty` | `gpg --dearmor` without `--batch` in CI | Use `gpg --batch --yes --dearmor \| sudo tee` | How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Diagnosing Azure Deployment Failures
Lookup-first triage against documented gotchas. If the symptom doesn't match a known entry, escalate to Microsoft's azure-diagnostics for live log/metric queries.
How to use this skill
- Get the failing symptom (error code, stack trace, observed behaviour)
- Match against the table below
- Apply the documented fix
- If no match, see references/gotchas.md for the full catalogue
- If still no match, capture a new gotcha via curating-azure-deployment-learnings
Quick symptom table
| Symptom | Likely cause | Fix |
|---|---|---|
BCP258: sqlAdminPassword missing |
Using .bicepparam instead of .parameters.json |
Keep params as .parameters.json; use @ prefix |
LocationNotAvailableForResourceType for SWA |
australiaeast not supported |
Hard-code swaLocation = 'eastasia' |
Multiple files found matching pattern *.sql |
azure/sql-action accepts only one file |
Replace with sqlcmd bash loop |
sqlcmd: command not found (exit 127) |
Not pre-installed on ubuntu-24.04 | Install mssql-tools18 via Microsoft apt repo |
gpg: cannot open /dev/tty |
gpg --dearmor without --batch in CI |
Use gpg --batch --yes --dearmor | sudo tee |
OIDC fails AADSTS70021 |
Federated credential subject mismatch | Must match repo:owner/repo:ref:refs/heads/branch exactly |
AZURE_CREDENTIALS auth fails silently |
WARNING: text prepended to SP JSON |
Strip with 2>/dev/null | python3 pipeline |
| Bicep runs on every push (slow) | No change detection | Add git diff check, conditional steps |
error TS7016: no declaration for 'mssql' |
@types/mssql missing |
Add @types/mssql matching the mssql major |
| New function returns 404 after deploy | Not imported in api/src/index.ts |
Add import './functions/{name}' |
| Functions return 500 on first request | SQL serverless auto-paused | Wait 30–60s, retry |
| Placeholder strings cause cryptic errors | Non-empty placeholders fool if (!value) |
Use "" in example files |
az functionapp create creates wrong plan |
CLI silently falls back to Y1/Dynamic | Use ARM REST API or Bicep for FC1 |
az appservice plan create --sku FC1 fails |
CLI doesn't support FC1 reliably | Use ARM REST API |
| ARM PUT doesn't change hosting plan | Can't migrate existing app | Delete and recreate |
FUNCTIONS_WORKER_RUNTIME causes failure |
Forbidden on FC1 | Remove from app settings |
az functionapp cors add returns Bad Request |
CLI CORS broken on FC1 | Use ARM REST API |
"main": "dist/functions/*.js" doesn't work |
Glob not resolved | Use "main": "dist/index.js" |
Missing package-lock.json breaks CI |
cache-dependency-path points to missing file |
Commit lock file |
| Publish profile auth 401 on FC1 | Kudu auth different on FC1 | OIDC azure/login@v3 + az functionapp deployment source config-zip |
Azure/functions-action step fails "repository disabled/not found" |
Marketplace action outage (June 2026) | Deploy with az functionapp deployment source config-zip (#46) |
| Kudu "management operation and deployment operation in quick succession" | Config write/restart right before zip deploy | Config → sleep 30 → deploy → restart (#47) |
| Functions missing after first zip deploy | v4 host doesn't discover from fresh zip until recycled | az functionapp restart after deploy (#48) |
| 503 "Service not configured" after infra deploy | Bicep reset app settings; restore step skipped | Restore in an always() job after infra (#49) |
| Cold start 15-30s on ACA | Large Docker image | Use Alpine, prune devDeps |
| SSE connections drop after 4 min | Default 240s request timeout | --request-timeout 1800 |
az containerapp update has no effect |
Unchanged secret values skip restart | az containerapp revision restart |
| Secrets not available in app | Env var not linked | --set-env-vars "VAR=secretref:secret-name" |
| Docker Hub image not pulled | Rate limit (100/6h anonymous) | Authenticated pulls or move to GHCR/ACR |
| Sidecar / public image broke with no code change | :latest tag drifted |
Pin by tag or digest (#38) |
az acr build "registry could not be found" |
AcrPush lacks ARM read, or cross-sub without --subscription |
Contributor scoped to the registry; pass --subscription (#50) |
Container App bills 24/7 at minReplicas: 0, replicas stuck at 1 |
Wake vectors / cooldownPeriod / CI resurrection / Activating on ImagePullFailure |
check-live-replicas.sh, then gotchas #41–#43, #51 |
--replica-retry-limit 0 ignored |
CLI treats 0 as falsy | az rest PATCH + read back (#52) |
| Job started from code has no env / exits non-zero | /start body replaces env; {template:…} wrapper is silently empty |
Clone container spec, append, POST top-level template (#53) |
DeploymentModelNotSupported (Azure OpenAI) |
Model version not available in region | Verify: az cognitiveservices model list --location ... |
EMAIL_FROM unknown before first deploy |
Azure-managed domain hash auto-generated | Retrieve post-deploy with az communication email domain show |
| Email send crashes HTTP handler | pollUntilDone() throws |
Use safeSend() wrapper |
| ACS resources fail with location error | Microsoft.Communication/* requires location: 'global' |
Hardcode location: 'global' |
ACS dataLocation fails |
Uses plain English, not region IDs | dataLocation: 'Australia' |
| ACS circular dependency | linkedDomains + dependsOn conflict |
Declare order: emailService → domain → acs |
403 on roleAssignments |
OIDC SP only has Contributor | Grant User Access Administrator at RG scope |
listSecrets output warning |
Bicep linter flags secrets in outputs | #disable-next-line outputs-should-not-contain-secrets |
| SWA self-referencing URL needed | APP_BASE_URL unknown before first deploy |
Use 'https://${swa.properties.defaultHostname}' |
| Can't test before Azure provisioned | No mock pattern | Check if (!process.env.KEY) → return mock |
local.settings.json placeholder strings |
Fake strings are truthy | Use "" for all user-input values |
Bearer auth 401s only behind SWA /api/* |
SWA edge overwrites Authorization |
Custom header such as x-api-key (#54) |
gh workflow run fails OIDC AADSTS70021 |
Dispatched from the wrong branch | --ref test / --ref production + a branch guard (#55) |
| SQL Server 2025 container crashes on Apple Silicon | RTM needs AVX; Docker Desktop emulation lacks it | Use 2022-latest + Rosetta, or 2025 CU1+ (#56) |
ACS beginSend() usage unclear |
Async poller API | beginSend() → pollUntilDone() in safeSend() (#35) |
| SQL Serverless bill higher than expected; DB never pauses | Health endpoint or scheduler polls the DB, keeping it awake 24/7 | DB-free shallow health check; or switch to flat Basic tier (~$5/mo). See cost-guardrails Guardrail #11 |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +18 lines · +27 tokens per session 0c76541f7bfb
- 1mo ago First seen · 92 lines · 99 tokens per session scan B e3d0334da94c
diagnosing-azure-deployment-failures is a skill published in the GitHub repository alexpizarro/azure-lean-stack-skills (1 stars, last pushed 1mo ago), licensed MIT. It adds 126 tokens to every session and 2,465 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
azure-kubernetes-automatic-readiness
Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility. Identifies incompatibilities, generates fixes, and guides migration from AKS Standard to AKS Automatic. WHEN: migrate to AKS Automatic, check AKS Automatic readiness, validate manifests for Automatic, assess cluster for Automatic…
azure-diagnostics
Debug Azure production issues using AppLens, Azure Monitor, resource health, and safe triage, including evidence-only diagnosis without live access. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target…
atmos-lint
Atmos Terraform linting with TFLint: standalone atmos terraform lint, component-aware config discovery and toolchain versions, TFLint rule configuration, and lifecycle hooks/CI findings. Use when configuring, running, debugging, or documenting Terraform/OpenTofu linting in an Atmos project.
azure-diagnostics
Investigate AKS, VM, App Service, Functions and messaging incidents using scoped evidence.
azure-expert
Expert-level Microsoft Azure cloud platform, services, and architecture. Use when the user mentions cloud, Microsoft platforms, Azure Functions, or Cosmos DB.
datadog-ninja
Master orchestrator for 57 official Datadog agent skills from DataDog/pup and datadog-labs/agent-skills. Use when working with ANY Datadog observability task: APM and distributed tracing, log search and pipelines, monitors and alerting, live production debugging, audit trail investigations, browser SDK…