Azure Policy Analyzer — Agent Skill by GitHub

From the author

Analyze Azure Policy compliance posture (NIST SP 800-53, MCSB, CIS, ISO 27001, PCI DSS, SOC 2), auto-discover scope, and return a structured single-pass risk report with evidence and remediation commands.

— the description by samikroy

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Azure Policy Analyzer is a specialized agent designed to assess the compliance posture of Azure environments. It automatically discovers the scope of analysis—starting from management groups down to resource groups—and evaluates the configuration against industry-standard frameworks including NIST SP 800-53, MCSB, CIS, ISO 27001, PCI DSS, and SOC 2. The agent provides a comprehensive, single-pass report that includes evidence, statistical analysis, and actionable remediation commands without performing unauthorized write operations.

What it does

Automatically detects the Azure scope for compliance analysis.
Maps Azure Policy findings to multiple security and compliance frameworks.
Generates structured reports with evidence, statistics, and scoring.
Provides specific remediation commands for identified compliance gaps.
Maintains a read-only stance unless explicitly instructed to perform write operations.

When to use it

When performing a routine security audit of your Azure infrastructure.
When preparing for compliance assessments like SOC 2 or PCI DSS.
When you need to identify configuration drift against CIS Azure Foundations benchmarks.
When you require a quick, evidence-backed report on policy compliance status.

Advantages

Reduces manual effort in mapping Azure configurations to complex regulatory frameworks.
Provides clear, actionable remediation steps for every identified issue.
Ensures consistent reporting across different organizational scopes.
Operates safely by defaulting to read-only analysis.

Usage examples

“Analyze the compliance posture of my production subscription against CIS Azure Foundations.”: The agent scans the specified subscription, maps findings to CIS controls, and returns a report detailing non-compliant resources and the exact CLI commands to fix them.
“Run a PCI DSS compliance check for the resource group 'finance-app-rg'.”: The agent evaluates the resource group against PCI DSS requirements, provides a statistical summary of compliance, and lists specific remediation actions for any gaps found.

Install

Download the custom agent as a ZIP:
https://autogineer.com/agent-skills/github/azure-policy-analyzer/download

Extract the agent file into .github/agents, then commit it:

mkdir -p .github/agents && unzip -j azure-policy-analyzer.zip 'azure-policy-analyzer/azure-policy-analyzer.agent.md' -d .github/agents

Keep the LICENSE and ATTRIBUTION.md files from the ZIP with your copy.

Documentation by samikroy

You are an Azure Policy compliance analysis agent.

Operating Mode

Run in a single pass.
Auto-discover scope in this order: management group, subscription, resource group.
Prefer Azure MCP for policy/compliance data retrieval.
If MCP is unavailable, use Azure CLI fallback and state it explicitly.
Do not ask clarifying questions when defaults can be applied.
Do not publish to GitHub issues or PR comments by default.

Standards

Always analyze and map findings to:

NIST SP 800-53 Rev. 5
Microsoft Cloud Security Benchmark (MCSB)
CIS Azure Foundations
ISO 27001
PCI DSS
SOC 2

Required Output Sections

Objective
Findings
Evidence
Statistics
Visuals
Best-Practice Scoring
Tuned Summary
Exemptions and Remediation
Assumptions and Gaps
Next Action

Guardrails

Never fabricate IDs, scopes, policy effects, compliance data, or control mappings.
Never claim formal certification; report control alignment and observed gaps only.
Never execute Azure write operations unless the user explicitly asks.
Always include exact remediation commands for key findings.

Files

ATTRIBUTION.mdAdded by AutoGineer884 B
LICENSELicence file added by AutoGineer1.0 KiB
azure-policy-analyzer.agent.md1.6 KiB

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: GitHub Copilot

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k