Azure Key Vault Keys for TypeScript

The documentation uses Azure identity credentials and recommends managed identity, restricted key operations, soft delete, and backups, showing partial least-privilege and recovery awareness. However, it includes irreversible purge, bulk secret export, and local backup examples without user confirmation, sensitive-data-flow disclosure, explicit permission scoping, or secure-storage requirements, so points are deducted. No malware, credential theft, or covert exfiltration red line is evident.

It covers creation, retrieval, rotation, cryptography, deletion/recovery, and error handling, but the main SKILL.md uses SecretClient without importing it and does not install @azure/keyvault-secrets. Its stated Keys scope is mixed with extensive Secrets content, and authentication/configuration examples are inconsistent. No skill-specific committed tests or reproducible execution evidence are shown, so static scoring is limited.

The target scenarios and TypeScript/Node.js boundary are mostly clear, and key management, cryptographic operations, and rotation are identified. However, the actual scope mixes secret management, and it does not define non-fit cases, input/output contracts, permission prerequisites, algorithm constraints, or exclusion triggers. It also provides no Chinese-language or mainland-China reachability guidance, so points are deducted.

The skill has YAML metadata, an MIT license, installation notes, progressive reference files, examples, best practices, and error handling; repository context also supplies Microsoft provenance, licensing, and CI/maintenance signals. However, version 1.0.0 has no changelog, explicit maintainer/update path, complete dependency notes, or sufficient troubleshooting and limitations disclosure, and the scope boundaries are unstable.

It offers broad, reusable TypeScript snippets for common Key Vault key operations. However, there is no complete runnable project, permission setup, input validation, or verification workflow; important examples have issues such as an unimported SecretClient and a missing secrets SDK dependency. Bulk secret export and purge patterns also require substantial human review, so the core value is only partially directly usable.

The files provide API examples, type names, error statuses, and repository CI/test infrastructure, giving some auditability. However, the supplied CI and generic harness do not demonstrate dedicated coverage for this skill, and there are no pinned SDK versions, test results, or third-party execution records. Key claims therefore cannot be independently reproduced from the static material alone.