natureco-cli 5.18.3 → 5.20.0

package/skills/analytics-setup/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: analytics-setup
+description: Set up analytics with event tracking, user properties, funnels, and dashboards
+category: Software Development
+---
+
+# Analytics Setup
+
+## Overview
+Set up analytics with event tracking, user properties, funnels, and dashboards. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply analytics setup best practices
+- When establishing processes or standards for your workflow
+- When training team members on analytics setup
+- When automating or optimizing analytics setup tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply analytics setup for my current project
+Assistant: I'll help you apply analytics setup step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/api-design/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: api-design
+description: Design RESTful and GraphQL APIs with consistency, versioning, and documentation
+category: Software Development
+---
+
+# Api Design
+
+## Overview
+Design RESTful and GraphQL APIs with consistency, versioning, and documentation. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply api design best practices
+- When establishing processes or standards for your workflow
+- When training team members on api design
+- When automating or optimizing api design tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply api design for my current project
+Assistant: I'll help you apply api design step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/api-versioning/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: api-versioning
+description: Version APIs with URL paths, headers, or content negotiation and deprecation policies
+category: Software Development
+---
+
+# Api Versioning
+
+## Overview
+Version APIs with URL paths, headers, or content negotiation and deprecation policies. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply api versioning best practices
+- When establishing processes or standards for your workflow
+- When training team members on api versioning
+- When automating or optimizing api versioning tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply api versioning for my current project
+Assistant: I'll help you apply api versioning step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/appinsights-instrumentation/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: appinsights-instrumentation
+description: "Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.2"
+---
+
+# AppInsights Instrumentation Guide
+
+This skill provides **guidance and reference material** for instrumenting webapps with Azure Application Insights.
+
+> **⛔ ADDING COMPONENTS?**
+>
+> If the user wants to **add App Insights to their app**, invoke **azure-prepare** instead.
+> This skill provides reference material—azure-prepare orchestrates the actual changes.
+
+## When to Use This Skill
+
+- User asks **how** to instrument (guidance, patterns, examples)
+- User needs SDK setup instructions
+- azure-prepare invokes this skill during research phase
+- User wants to understand App Insights concepts
+
+## When to Use azure-prepare Instead
+
+- User says "add telemetry to my app"
+- User says "add App Insights" 
+- User wants to modify their project
+- Any request to change/add components
+
+## Prerequisites
+
+The app in the workspace must be one of these kinds
+
+- An ASP.NET Core app hosted in Azure
+- A Node.js app hosted in Azure
+
+## Guidelines
+
+### Collect context information
+
+Find out the (programming language, application framework, hosting) tuple of the application the user is trying to add telemetry support in. This determines how the application can be instrumented. Read the source code to make an educated guess. Confirm with the user on anything you don't know. You must always ask the user where the application is hosted (e.g. on a personal computer, in an Azure App Service as code, in an Azure App Service as container, in an Azure Container App, etc.). 
+
+### Prefer auto-instrument if possible
+
+If the app is a C# ASP.NET Core app hosted in Azure App Service, use [AUTO guide](references/auto.md) to help user auto-instrument the app.
+
+### Manually instrument
+
+Manually instrument the app by creating the AppInsights resource and update the app's code. 
+
+#### Create AppInsights resource
+
+Use one of the following options that fits the environment.
+
+- Add AppInsights to existing Bicep template. See [examples/appinsights.bicep](examples/appinsights.bicep) for what to add. This is the best option if there are existing Bicep template files in the workspace.
+- Use Azure CLI. See [scripts/appinsights.ps1](scripts/appinsights.ps1) for what Azure CLI command to execute to create the App Insights resource.
+
+No matter which option you choose, recommend the user to create the App Insights resource in a meaningful resource group that makes managing resources easier. A good candidate will be the same resource group that contains the resources for the hosted app in Azure.
+
+#### Modify application code
+
+- If the app is an ASP.NET Core app, see [ASPNETCORE guide](references/aspnetcore.md) for how to modify the C# code.
+- If the app is a Node.js app, see [NODEJS guide](references/nodejs.md) for how to modify the JavaScript/TypeScript code.
+- If the app is a Python app, see [PYTHON guide](references/python.md) for how to modify the Python code.
+
+## SDK Quick References
+
+- **OpenTelemetry Distro**: [Python](references/sdk/azure-monitor-opentelemetry-py.md) | [TypeScript](references/sdk/azure-monitor-opentelemetry-ts.md)
+- **OpenTelemetry Exporter**: [Python](references/sdk/azure-monitor-opentelemetry-exporter-py.md) | [Java](references/sdk/azure-monitor-opentelemetry-exporter-java.md)
+
+## Platform-Specific Guides
+
+- **Container Apps**: [Observability Guide](references/container-apps.md)

package/skills/audio-transcription/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: audio-transcription
+description: Transcribe audio with speaker diarization, timestamps, and confidence scoring
+category: Intelligence & General
+---
+
+# Audio Transcription
+
+## Overview
+Transcribe audio with speaker diarization, timestamps, and confidence scoring. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply audio transcription best practices
+- When establishing processes or standards for your workflow
+- When training team members on audio transcription
+- When automating or optimizing audio transcription tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply audio transcription for my current project
+Assistant: I'll help you apply audio transcription step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/authentication-patterns/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: authentication-patterns
+description: Implement authentication with JWT, OAuth2, SSO, MFA, and session management
+category: Software Development
+---
+
+# Authentication Patterns
+
+## Overview
+Implement authentication with JWT, OAuth2, SSO, MFA, and session management. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply authentication patterns best practices
+- When establishing processes or standards for your workflow
+- When training team members on authentication patterns
+- When automating or optimizing authentication patterns tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply authentication patterns for my current project
+Assistant: I'll help you apply authentication patterns step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/authorization-rbac/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: authorization-rbac
+description: Implement role-based access control with permissions, policies, and attribute checks
+category: Software Development
+---
+
+# Authorization Rbac
+
+## Overview
+Implement role-based access control with permissions, policies, and attribute checks. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply authorization rbac best practices
+- When establishing processes or standards for your workflow
+- When training team members on authorization rbac
+- When automating or optimizing authorization rbac tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply authorization rbac for my current project
+Assistant: I'll help you apply authorization rbac step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/azure-ai/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: azure-ai
+description: "Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.1"
+---
+
+# Azure AI Services
+
+## Services
+
+| Service | Use When | MCP Tools | CLI |
+|---------|----------|-----------|-----|
+| AI Search | Full-text, vector, hybrid search | `azure__search` | `az search` |
+| Speech | Speech-to-text, text-to-speech | `azure__speech` | - |
+| OpenAI | GPT models, embeddings, DALL-E | - | `az cognitiveservices` |
+| Document Intelligence | Form extraction, OCR | - | - |
+
+## MCP Server (Preferred)
+
+When Azure MCP is enabled:
+
+### AI Search
+- `azure__search` with command `search_index_list` - List search indexes
+- `azure__search` with command `search_index_get` - Get index details
+- `azure__search` with command `search_query` - Query search index
+
+### Speech
+- `azure__speech` with command `speech_transcribe` - Speech to text
+- `azure__speech` with command `speech_synthesize` - Text to speech
+
+**If Azure MCP is not enabled:** Run `/azure:setup` or enable via `/mcp`.
+
+## AI Search Capabilities
+
+| Feature | Description |
+|---------|-------------|
+| Full-text search | Linguistic analysis, stemming |
+| Vector search | Semantic similarity with embeddings |
+| Hybrid search | Combined keyword + vector |
+| AI enrichment | Entity extraction, OCR, sentiment |
+
+## Speech Capabilities
+
+| Feature | Description |
+|---------|-------------|
+| Speech-to-text | Real-time and batch transcription |
+| Text-to-speech | Neural voices, SSML support |
+| Speaker diarization | Identify who spoke when |
+| Custom models | Domain-specific vocabulary |
+
+## SDK Quick References
+
+For programmatic access to these services, see the condensed SDK guides:
+
+- **AI Search**: [Python](references/sdk/azure-search-documents-py.md) | [TypeScript](references/sdk/azure-search-documents-ts.md) | [.NET](references/sdk/azure-search-documents-dotnet.md)
+- **OpenAI**: [.NET](references/sdk/azure-ai-openai-dotnet.md)
+- **Vision**: [Python](references/sdk/azure-ai-vision-imageanalysis-py.md) | [Java](references/sdk/azure-ai-vision-imageanalysis-java.md)
+- **Transcription**: [Python](references/sdk/azure-ai-transcription-py.md)
+- **Translation**: [Python](references/sdk/azure-ai-translation-text-py.md) | [TypeScript](references/sdk/azure-ai-translation-ts.md)
+- **Document Intelligence**: [.NET](references/sdk/azure-ai-document-intelligence-dotnet.md) | [TypeScript](references/sdk/azure-ai-document-intelligence-ts.md)
+- **Content Safety**: [Python](references/sdk/azure-ai-contentsafety-py.md) | [TypeScript](references/sdk/azure-ai-contentsafety-ts.md) | [Java](references/sdk/azure-ai-contentsafety-java.md)
+
+## Service Details
+
+For deep documentation on specific services:
+
+- AI Search indexing and queries -> [Azure AI Search documentation](https://learn.microsoft.com/azure/search/search-what-is-azure-search)
+- Speech transcription patterns -> [Azure AI Speech documentation](https://learn.microsoft.com/azure/ai-services/speech-service/overview)

package/skills/azure-aigateway/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: azure-aigateway
+description: "Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbreak detection, add Azure OpenAI backend, add AI Foundry model, test AI gateway, LLM policies, configure AI backend, token metrics, AI cost control, convert API to MCP, import OpenAPI to gateway."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "3.1.1"
+compatibility: Requires Azure CLI (az) for configuration and testing
+---
+
+# Azure AI Gateway
+
+Configure Azure API Management (APIM) as an AI Gateway for governing AI models, MCP tools, and agents.
+
+> **To deploy APIM**, use the **azure-prepare** skill. See [APIM deployment guide](https://learn.microsoft.com/azure/api-management/get-started-create-service-instance).
+
+## When to Use This Skill
+
+| Category | Triggers |
+|----------|----------|
+| **Model Governance** | "semantic caching", "token limits", "load balance AI", "track token usage" |
+| **Tool Governance** | "rate limit MCP", "protect my tools", "configure my tool", "convert API to MCP" |
+| **Agent Governance** | "content safety", "jailbreak detection", "filter harmful content" |
+| **Configuration** | "add Azure OpenAI backend", "configure my model", "add AI Foundry model" |
+| **Testing** | "test AI gateway", "call OpenAI through gateway" |
+
+---
+
+## Quick Reference
+
+| Policy | Purpose | Details |
+|--------|---------|---------|
+| `azure-openai-token-limit` | Cost control | [Model Policies](references/policies.md#token-rate-limiting) |
+| `azure-openai-semantic-cache-lookup/store` | 60-80% cost savings | [Model Policies](references/policies.md#semantic-caching) |
+| `azure-openai-emit-token-metric` | Observability | [Model Policies](references/policies.md#token-metrics) |
+| `llm-content-safety` | Safety & compliance | [Agent Policies](references/policies.md#content-safety) |
+| `rate-limit-by-key` | MCP/tool protection | [Tool Policies](references/policies.md#request-rate-limiting) |
+
+---
+
+## Get Gateway Details
+
+```bash
+# Get gateway URL
+az apim show --name <apim-name> --resource-group <rg> --query "gatewayUrl" -o tsv
+
+# List backends (AI models)
+az apim backend list --service-name <apim-name> --resource-group <rg> \
+  --query "[].{id:name, url:url}" -o table
+
+# Get subscription key
+az apim subscription keys list \
+  --service-name <apim-name> --resource-group <rg> --subscription-id <sub-id>
+```
+
+---
+
+## Test AI Endpoint
+
+```bash
+GATEWAY_URL=$(az apim show --name <apim-name> --resource-group <rg> --query "gatewayUrl" -o tsv)
+
+curl -X POST "${GATEWAY_URL}/openai/deployments/<deployment>/chat/completions?api-version=2024-02-01" \
+  -H "Content-Type: application/json" \
+  -H "Ocp-Apim-Subscription-Key: <key>" \
+  -d '{"messages": [{"role": "user", "content": "Hello"}], "max_tokens": 100}'
+```
+
+---
+
+## Common Tasks
+
+### Add AI Backend
+
+See [references/patterns.md](references/patterns.md#pattern-1-add-ai-model-backend) for full steps.
+
+```bash
+# Discover AI resources
+az cognitiveservices account list --query "[?kind=='OpenAI']" -o table
+
+# Create backend
+az apim backend create --service-name <apim> --resource-group <rg> \
+  --backend-id openai-backend --protocol http --url "https://<aoai>.openai.azure.com/openai"
+
+# Grant access (managed identity)
+az role assignment create --assignee <apim-principal-id> \
+  --role "Cognitive Services User" --scope <aoai-resource-id>
+```
+
+### Apply AI Governance Policy
+
+Recommended policy order in `<inbound>`:
+
+1. **Authentication** - Managed identity to backend
+2. **Semantic Cache Lookup** - Check cache before calling AI
+3. **Token Limits** - Cost control
+4. **Content Safety** - Filter harmful content
+5. **Backend Selection** - Load balancing
+6. **Metrics** - Token usage tracking
+
+See [references/policies.md](references/policies.md#combining-policies) for complete example.
+
+---
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|----------|
+| Token limit 429 | Increase `tokens-per-minute` or add load balancing |
+| No cache hits | Lower `score-threshold` to 0.7 |
+| Content false positives | Increase category thresholds (5-6) |
+| Backend auth 401 | Grant APIM "Cognitive Services User" role |
+
+See [references/troubleshooting.md](references/troubleshooting.md) for details.
+
+---
+
+## References
+
+- [**Detailed Policies**](references/policies.md) - Full policy examples
+- [**Configuration Patterns**](references/patterns.md) - Step-by-step patterns
+- [**Troubleshooting**](references/troubleshooting.md) - Common issues
+- [AI-Gateway Samples](https://github.com/Azure-Samples/AI-Gateway)
+- [GenAI Gateway Docs](https://learn.microsoft.com/azure/api-management/genai-gateway-capabilities)
+
+## SDK Quick References
+
+- **Content Safety**: [Python](references/sdk/azure-ai-contentsafety-py.md) | [TypeScript](references/sdk/azure-ai-contentsafety-ts.md)
+- **API Management**: [Python](references/sdk/azure-mgmt-apimanagement-py.md) | [.NET](references/sdk/azure-mgmt-apimanagement-dotnet.md)

package/skills/azure-cloud-migrate/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: azure-cloud-migrate
+description: "Assess and migrate cross-cloud workloads to Azure with reports and code conversion. Supports Lambda→Functions, Beanstalk/Heroku/App Engine→App Service, Fargate/Kubernetes/Cloud Run/Spring Boot→Container Apps. WHEN: migrate Lambda to Functions, AWS to Azure, migrate Beanstalk, migrate Heroku, migrate App Engine, Cloud Run migration, Fargate to ACA, ECS/Kubernetes/GKE/EKS to Container Apps, Spring Boot to Container Apps, cross-cloud migration."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.2.1"
+---
+
+# Azure Cloud Migrate
+
+> This skill handles **assessment and code migration** of existing cloud workloads to Azure.
+
+## Rules
+
+1. Follow phases sequentially — do not skip
+2. Generate assessment before any code migration
+3. Load the scenario reference and follow its rules
+4. Use `mcp_azure_mcp_get_azure_bestpractices` and `mcp_azure_mcp_documentation` MCP tools
+5. Use the latest supported runtime for the target service
+6. Destructive actions require `ask_user` — [functions global-rules](references/services/functions/global-rules.md) | [app-service global-rules](references/services/app-service/global-rules.md)
+7. **Report progress to user** — During long-running operations (deployments, image pushes), provide resource-level status updates so the user is never left waiting without feedback — see [workflow-details.md](references/workflow-details.md)
+8. **Audit service discovery in app code** — Kubernetes DNS names (e.g., `http://order-service:3001`) do not resolve in Container Apps. During assessment, scan source code for hardcoded hostnames/ports in HTTP clients and flag them for env-var-driven URL injection
+
+## Migration Scenarios
+
+| Source | Target | Reference |
+|--------|--------|-----------|
+| AWS Lambda | Azure Functions | [lambda-to-functions.md](references/services/functions/lambda-to-functions.md) ([assessment](references/services/functions/assessment.md), [code-migration](references/services/functions/code-migration.md)) |
+| AWS Elastic Beanstalk | Azure App Service | [beanstalk-to-app-service.md](references/services/app-service/beanstalk-to-app-service.md) |
+| Heroku | Azure App Service | [heroku-to-app-service.md](references/services/app-service/heroku-to-app-service.md) |
+| Google App Engine | Azure App Service | [app-engine-to-app-service.md](references/services/app-service/app-engine-to-app-service.md) |
+| AWS Fargate (ECS) | Azure Container Apps | [fargate-to-container-apps.md](references/services/container-apps/fargate-to-container-apps.md) ([assessment](references/services/container-apps/fargate-assessment-guide.md), [deployment](references/services/container-apps/fargate-deployment-guide.md)) |
+| Kubernetes (GKE/EKS/Self-hosted) | Azure Container Apps | [k8s-to-container-apps.md](references/services/container-apps/k8s-to-container-apps.md) |
+| GCP Cloud Run | Azure Container Apps | [cloudrun-to-container-apps.md](references/services/container-apps/cloudrun-to-container-apps.md) |
+| Spring Boot (Azure Spring Apps/VMs) | Azure Container Apps | [spring-apps-to-aca.md](references/services/container-apps/spring-apps-to-aca.md) |
+
+> No matching scenario? Use `mcp_azure_mcp_documentation` and `mcp_azure_mcp_get_azure_bestpractices` tools.
+
+## Output Directory
+
+All output goes to `<workspace-root-basename>-azure/` at workspace root, where `<workspace-root-basename>` is the name of the top-level workspace directory itself (NOT a subdirectory within it). Never modify the source directory.
+
+## Steps
+
+1. **Create** `<workspace-root-basename>-azure/` at workspace root
+2. **Assess** — Analyze source, map services, generate report using the scenario-specific assessment guide → [functions assessment](references/services/functions/assessment.md) | [app-service assessment](references/services/app-service/assessment.md)
+3. **Migrate** — Convert code/config using the scenario-specific migration guide → [functions code-migration](references/services/functions/code-migration.md) | [app-service code-migration](references/services/app-service/code-migration.md)
+4. **Ask User** — "Migration complete. Test locally or deploy to Azure?"
+5. **Hand off** to azure-prepare for infrastructure, testing, and deployment
+
+Track progress in `migration-status.md` — see [workflow-details.md](references/workflow-details.md).

package/skills/azure-compliance/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: azure-compliance
+description: "Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.1"
+---
+
+# Azure Compliance & Security Auditing
+
+## Quick Reference
+
+| Property | Details |
+|---|---|
+| Best for | Compliance scans, security audits, Key Vault expiration checks |
+| Primary capabilities | Comprehensive Resources Assessment, Key Vault Expiration Monitoring |
+| MCP tools | azqr, subscription and resource group listing, Key Vault item inspection |
+
+## When to Use This Skill
+
+- Run azqr or Azure Quick Review for compliance assessment
+- Validate Azure resource configuration against best practices
+- Identify orphaned or misconfigured resources
+- Audit Key Vault keys, secrets, and certificates for expiration
+
+## Skill Activation Triggers
+
+Activate this skill when user wants to:
+- Check Azure compliance or best practices
+- Assess Azure resources for configuration issues
+- Run azqr or Azure Quick Review
+- Identify orphaned or misconfigured resources
+- Review Azure security posture
+- "Show me expired certificates/keys/secrets in my Key Vault"
+- "Check what's expiring in the next 30 days"
+- "Audit my Key Vault for compliance"
+- "Find secrets without expiration dates"
+- "Check certificate expiration dates"
+
+## Prerequisites
+
+- Authentication: user is logged in to Azure via `az login`
+- Permissions to read resource configuration and Key Vault metadata
+
+## Assessments
+
+| Assessment | Reference |
+|------------|-----------|
+| Comprehensive Compliance (azqr) | [references/azure-quick-review.md](references/azure-quick-review.md) |
+| Key Vault Expiration | [references/azure-keyvault-expiration-audit.md](references/azure-keyvault-expiration-audit.md) |
+| Resource Graph Queries | [references/azure-resource-graph.md](references/azure-resource-graph.md) |
+
+## MCP Tools
+
+| Tool | Purpose |
+|------|---------|
+| `mcp_azure_mcp_extension_azqr` | Run azqr compliance scans |
+| `mcp_azure_mcp_subscription_list` | List available subscriptions |
+| `mcp_azure_mcp_group_list` | List resource groups |
+| `keyvault_key_list` | List all keys in vault |
+| `keyvault_key_get` | Get key details including expiration |
+| `keyvault_secret_list` | List all secrets in vault |
+| `keyvault_secret_get` | Get secret details including expiration |
+| `keyvault_certificate_list` | List all certificates in vault |
+| `keyvault_certificate_get` | Get certificate details including expiration |
+
+## Assessment Workflow
+
+1. Select scope (subscription or resource group) for Comprehensive Resources Assessment.
+2. Run azqr and capture output artifacts.
+3. Analyze Scan Results and summarize findings and recommendations.
+4. Review Key Vault Expiration Monitoring output for keys, secrets, and certificates.
+5. Classify issues and propose remediation or fix steps for each finding.
+
+### Priority Classification
+
+| Priority | Guidance |
+|---|---|
+| Critical | Immediate remediation required for high-impact exposure |
+| High | Resolve within days to reduce risk |
+| Medium | Plan a resolution in the next sprint |
+| Low | Track and fix during regular maintenance |
+
+## Error Handling
+
+| Error | Message | Remediation |
+|---|---|---|
+| Authentication required | "Please login" | Run `az login` and retry |
+| Access denied | "Forbidden" | Confirm permissions and fix role assignments |
+| Missing resource | "Not found" | Verify subscription and resource group selection |
+
+## Best Practices
+
+- Run compliance scans on a regular schedule (weekly or monthly)
+- Track findings over time and verify remediation effectiveness
+- Separate compliance reporting from remediation execution
+- Keep Key Vault expiration policies documented and enforced
+
+## SDK Quick References
+
+For programmatic Key Vault access, see the condensed SDK guides:
+
+- **Key Vault (Python)**: [Secrets/Keys/Certs](references/sdk/azure-keyvault-py.md)
+- **Secrets**: [TypeScript](references/sdk/azure-keyvault-secrets-ts.md) | [Rust](references/sdk/azure-keyvault-secrets-rust.md) | [Java](references/sdk/azure-security-keyvault-secrets-java.md)
+- **Keys**: [.NET](references/sdk/azure-security-keyvault-keys-dotnet.md) | [Java](references/sdk/azure-security-keyvault-keys-java.md) | [TypeScript](references/sdk/azure-keyvault-keys-ts.md) | [Rust](references/sdk/azure-keyvault-keys-rust.md)
+- **Certificates**: [Rust](references/sdk/azure-keyvault-certificates-rust.md)
+