Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add niels-emmer/myace --skill azure-waf-reviewgit clone --depth 1 https://github.com/niels-emmer/myaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/niels-emmer/myace/azure-waf-review)<a href="https://agentmods.dev/skills/niels-emmer/myace/azure-waf-review"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/azure-waf-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/niels-emmer/myace/azure-waf-review"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/azure-waf-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.00887 |
| Opus 5.5 | $0.00015 | $0.00355 |
| Sonnet 5.5 | $0.00007 | $0.00177 |
| Haiku 4.5 | $0.00004 | $0.00089 |
Grade A, and why
Azure WAF Pillar Review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
The Azure Well-Architected Framework (WAF) is Microsoft's set of design
principles for building reliable, secure, cost-optimized, operationally
excellent, and performant workloads on Azure. This skill is the Azure-specific
companion to iac-expert's generic well-architected-review skill: it maps
each pillar to the concrete Azure services and decisions that actually move
the needle, so a review checks real Azure constructs rather than abstract
principles.
When to use it
Before calling any nontrivial Azure infrastructure change done — new resources, materially changed configuration, anything that affects how the workload is reached, scaled, secured, or paid for. Skip it for genuinely cosmetic changes (a tag fix, a variable rename with no resource impact).
The pillars, and what to actually check in Azure
Reliability. Does the resource have a single point of failure it didn't have to have? Consider availability zones (zone-redundant storage, zonal VMs, zone-redundant App Service plans), availability sets for legacy VMs, and redundancy tiers (LRS vs. ZRS vs. GRS for storage). If it fails, what notices and how does recovery happen — automatically (Azure Monitor alerts, autoscale, failover) or does someone have to intervene? Does the change affect an existing backup path (Azure Backup, geo-replication, traffic-manager/front-door failover)?
Security. Does this follow private-by-default networking (private endpoints, VNet integration, no public IPs) and managed-identity-over-secrets? Does it grant any new RBAC permission, and is it scoped to least privilege rather than a broad Contributor/Owner role? Does it introduce or remove a documented exception? Is Defender for Cloud posture and Azure Policy coverage still intact?
Cost optimization. Does the resource size/tier match actual expected load,
or is it a guess to revisit after real usage data? Is there a cheaper tier or
pricing model (serverless/consumption vs. provisioned, reserved instances or
Azure savings plans vs. pay-as-you-go) that fits the workload's actual traffic
pattern? Is spend attributable to a specific cost-center tag so it shows up
correctly in Azure Cost Management?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 80 lines · 37 tokens per session scan A 65ceed118eb1
Azure WAF Pillar Review is a skill published in the GitHub repository niels-emmer/myace (1 stars, last pushed 2d ago), licensed MIT. It adds 37 tokens to every session and 887 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
loom-kubernetes
Kubernetes deployment, cluster architecture, security, and operations. Not for: a loom orchestration job or CI pipeline job — see loom-ci-cd.
loom-prometheus
Prometheus monitoring and alerting for cloud-native observability. Not for: a loom orchestration job or CI pipeline job — see loom-ci-cd.
ai-foundry-posture-check
Assess security, reliability, and cost posture of Azure OpenAI and Microsoft Foundry deployments. Detects critical anti-patterns: API keys instead of Managed Identity, public endpoints without firewall, disabled content filtering, missing diagnostic settings, deprecated model versions, over-provisioned PTU, absence of…
digital-native-governance-check
Assess Azure governance maturity for Digital Natives and startups. Detects the most common anti-patterns from the "Digital Natives on Azure" series: incomplete Service Health alerts, flat subscription topology without Management Groups, excessive RBAC (everyone is Owner), missing budget alerts, no Managed Identity…
well-architected-review
Run a Well-Architected Framework (WAF) review against Azure resources in scope. Use when asked about best practices, architecture review, WAF assessment, or pillar compliance (Reliability, Security, Cost, Operational Excellence, Performance Efficiency).
compliance-governance-audit
Audit Azure environment for compliance and governance posture. Checks Azure Policy, RBAC, tagging, resource locks, naming conventions, and regulatory alignment. Use when asked about compliance, governance, audit readiness, or policy violations.