azure-sql

azure-sql is a skill for Claude Code, Codex from BagelHole/DevOps-Security-Agent-Skills. It costs 28 tokens per session (3,630 once invoked), scanned B, original, MIT.

Azure SQL is a managed database service for relational SQL databases, alongside Cosmos DB for globally distributed NoSQL data. Microsoft manages much of the underlying database operation.

In plain words
What is it for?
Use it to provision Azure SQL databases and Elastic Pools, configure firewall and identity access, set up geo-replication and backups, tune performance, or deploy Cosmos DB.
Why use it?
It reduces the work of running database servers while providing options for backups, security, scaling, and geographic recovery. It also supports moving SQL Server workloads to Azure.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to provision Azure SQL databases and Elastic Pools, configure firewall and identity access, set up geo-replication and backups, tune performance, or deploy Cosmos DB.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/bagelhole/devops-security-agent-skills/azure-sql
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill azure-sql
Clone the repo
git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for azure-sql

README.md
[![agentmods](https://agentmods.dev/badge/skills/bagelhole/devops-security-agent-skills/azure-sql.svg)](https://agentmods.dev/skills/bagelhole/devops-security-agent-skills/azure-sql)
Your own site
<a href="https://agentmods.dev/skills/bagelhole/devops-security-agent-skills/azure-sql"><img src="https://agentmods.dev/badge/skills/bagelhole/devops-security-agent-skills/azure-sql.svg" alt="Measured on agentmods" height="20"></a>
Per session 28 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,630 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 3 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Supply Chain · line 26
    Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
    Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
  • high Tool Misuse · line 26
    Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
    Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
  • medium Privilege Escalation · line 26
    Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
    Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
  • medium Data Exfiltration · line 162
    Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
    Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00028 $0.03630
Opus 5 $0.00014 $0.01815
Sonnet 5 $0.00006 $0.00726
Haiku 4.5 $0.00003 $0.00363

Measured 4d ago against content hash be9c84370e42, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-08, from the pricing page.

Security

Grade B, and why

azure-sql scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootlowPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Downloads and executes remote codemediumSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
infrastructure/cloud-azure/azure-sql/SKILL.md · 498 lines

How it starts

The opening of the file, as written. The whole thing — 498 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Azure SQL

Deploy and manage Azure SQL Database, Elastic Pools, and Cosmos DB. Covers server provisioning, firewall rules, geo-replication, backup strategies, performance tuning, security hardening, and Terraform configurations.

When to Use

  • You need a fully managed relational database on Azure.
  • Your application requires geo-replication for disaster recovery.
  • You need elastic scaling across multiple databases with Elastic Pools.
  • You are migrating on-premises SQL Server workloads to the cloud.
  • You need a globally distributed NoSQL database (Cosmos DB).

Prerequisites

# Install Azure CLI
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Login and set subscription
az login
az account set --subscription "my-subscription-id"

# Create resource group
az group create --name database-rg --location eastus

SQL Server and Database Creation

Create SQL Server

# Create logical SQL server
az sql server create \
  --resource-group database-rg \
  --name myapp-sqlserver \
  --location eastus \
  --admin-user sqladmin \
  --admin-password 'S3cur3P@ssw0rd!' \
  --enable-public-network false \
  --minimal-tls-version 1.2

# Enable Azure AD authentication
az sql server ad-admin create \
  --resource-group database-rg \
  --server-name myapp-sqlserver \
  --display-name "SQL Admins" \
  --object-id "{aad-group-object-id}"

# Enable Azure AD only authentication (disable SQL auth)
az sql server ad-only-auth enable \
  --resource-group database-rg \
  --name myapp-sqlserver

Create Databases

# Create General Purpose database
az sql db create \
  --resource-group database-rg \
  --server myapp-sqlserver \
  --name myapp-db \
  --edition GeneralPurpose \
  --compute-model Serverless \
  --auto-pause-delay 60 \
  --min-capacity 0.5 \
  --max-size 32GB \
  --backup-storage-redundancy Geo \
  --zone-redundant false

# Create Business Critical database for production
az sql db create \
  --resource-group database-rg \
  --server myapp-sqlserver \
  --name myapp-prod-db \
  --edition BusinessCritical \
  --service-objective BC_Gen5_4 \
  --max-size 256GB \
  --backup-storage-redundancy Geo \
  --zone-redundant true \
  --read-scale Enabled

# Create Hyperscale database for large workloads
az sql db create \
  --resource-group database-rg \
  --server myapp-sqlserver \
  --name myapp-analytics-db \
  --edition Hyperscale \
  --service-objective HS_Gen5_4 \
  --ha-replicas 2

# List databases on server
az sql db list \
  --resource-group database-rg \
  --server myapp-sqlserver \
  --output table

Read the full file on GitHub · 498 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 498 lines · 28 tokens per session scan B be9c84370e42

Subscribe to this mod's changes

azure-sql is a skill published in the GitHub repository BagelHole/DevOps-Security-Agent-Skills (1,058 stars, last pushed 3mo ago), licensed MIT. It adds 28 tokens to every session and 3,630 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

rds

AWS RDS relational database service for managed databases. Use when provisioning databases, configuring backups, managing replicas, troubleshooting connectivity, or optimizing performance.

itsmostafa/aws-agent-skills · 31 tokens

aws-essentials

Use when standing up the core AWS surface a small product needs: hardening a fresh account, a private S3 bucket, encrypted RDS Postgres, ECS Fargate vs EC2, CloudFront + OAC, or scoping an IAM policy to least privilege. NOT the CI pipeline that ships the container (that is deployment), NOT app-code access-control…

ericrisco/rsc-harness · 89 tokens

implementing-aws-config-rules-for-compliance

Implementing AWS Config rules for continuous compliance monitoring of AWS resources, deploying managed and custom rules aligned to CIS and PCI DSS frameworks, configuring automatic remediation with SSM Automation, and aggregating compliance data across accounts.

adriannoes/awesome-agentic-ai · 53 tokens

implementing-aws-config-rules-for-compliance

Implementing AWS Config rules for continuous compliance monitoring of AWS resources, deploying managed and custom rules aligned to CIS and PCI DSS frameworks, configuring automatic remediation with SSM Automation, and aggregating compliance data across accounts.

xalgorix/xalgorix · 53 tokens

implementing-aws-security-hub-compliance

Implementing AWS Security Hub to aggregate security findings across AWS accounts, enable compliance standards like CIS AWS Foundations and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security insights for organizational risk management.

xalgorix/xalgorix · 53 tokens

ec2

AWS EC2 virtual machine management — instances, security groups, key pairs, AMIs, EBS volumes, Auto Scaling Groups, Spot Instances, Session Manager, placement groups, and instance lifecycle automation. Trigger on ANY of these, even when EC2 isn't named explicitly: - Launching or provisioning: "spin up a server"…

itsmostafa/aws-agent-skills · 320 tokens