Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add zmustafa/AzureSupportAgent --skill access-reviewgit clone --depth 1 https://github.com/zmustafa/AzureSupportAgentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zmustafa/azuresupportagent/access-review)<a href="https://agentmods.dev/skills/zmustafa/azuresupportagent/access-review"><img src="https://agentmods.dev/badge/skills/zmustafa/azuresupportagent/access-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zmustafa/azuresupportagent/access-review"><img src="https://agentmods.dev/badge/skills/zmustafa/azuresupportagent/access-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.00212 |
| Opus 5 | $0.00016 | $0.00106 |
| Sonnet 5 | $0.00007 | $0.00042 |
| Haiku 4.5 | $0.00003 | $0.00021 |
Grade A, and why
Azure and Entra access review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Azure and Entra access review
- Start from the cached IAM access model so direct, inherited, group-derived, ownership, PIM, control-plane, and data-plane paths are evaluated together.
- Resolve the exact principal and scope before answering who can do what.
- Distinguish active, eligible, and activated access; never call eligibility standing access.
- Include deny assignments, notActions, scope inheritance, and unresolved ABAC conditions.
- Use
why_does_principal_have_accessbefore proposing removal andsimulate_revokebefore a real revocation. - Report stale or absent scan coverage explicitly.
- Recommend least-privilege changes with the assignment id and blast radius, but keep writes behind the approval policy.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 16 lines · 33 tokens per session scan A a901f2646965
Azure and Entra access review is a skill published in the GitHub repository zmustafa/AzureSupportAgent (45 stars, last pushed yesterday), licensed MIT. It adds 33 tokens to every session and 212 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
applying-azure-cost-guardrails
Applies Azure cost guardrails to a deployment — verifies consumption-priced SKUs, scale-to-zero on Container Apps, SQL Serverless auto-pause, Log Analytics dailyQuotaGb cap, Storage lifecycle rules, and the free tiers (SWA Free, ACS 100 emails/day, App Insights 5GB/mo). Audits an existing project's Bicep for…
deploying-azure-static-web-apps
Deploys React + Azure Functions apps to Azure Static Web Apps with managed API functions, including the CommonJS / index.ts import / route-registration gotchas that make new functions 404 silently. Provides the SWA Bicep module, staticwebapp.config.json routing + security headers, and the API entrypoint convention.…
scheduling-with-azure-logic-apps-consumption
Creates Azure Logic Apps on the Consumption tier for recurring HTTP triggers and lightweight Power-Automate-style flows. Costs $0.22/month for a 5-minute recurrence (8,640 actions at $0.000025 each). Use when adding a scheduled webhook ping, polling a SharePoint list, ticking a microservice every N minutes, or…
adding-azure-communication-services-email
Adds transactional email to an Azure web app via Azure Communication Services (ACS) Email — verification emails, password resets, notifications. Encodes the three ACS quirks that consistently break Bicep deploys (location:'global' literal, dataLocation in plain English not Azure region IDs, declare-order to avoid…
deploying-azure-container-apps
Deploys Docker containers to Azure Container Apps with scale-to-zero, multi-container sidecars, shared managed environments, and Container Apps Jobs for batch workloads. Use when SWA + FC1 don't fit — long-running servers, WebSocket/SSE streaming, custom Docker runtimes, scheduled or queue-driven background jobs, or…
developing-azure-apps-locally
Runs an Azure Lean Stack app fully offline on localhost — API + SQL Server + blob storage — with no Azure dependency, as the "try" tier of the local→test→prod flow on the main branch. Provides a docker-compose stack (SQL Server 2022 + Azurite), a one-command bootstrap, mock-mode for unset service keys, and an optional…