Azure Key Vault SDK for Python

The skill recommends DefaultAzureCredential, Entra auditing, managed identity, RBAC, soft delete, and recovery, while discouraging connection strings and API keys, which supports a relatively strong baseline. Points are deducted because examples print secret values, deletion and permanent purge lack user confirmation, preflight authorization checks, or safeguards, and sensitive logging, data flow, and dependency-security risks are not disclosed.

The main paths cover installation, sync and async clients, lifecycle management, error handling, and cleanup, with examples for common exceptions and 403 feedback. Points are deducted because the document says local DefaultAzureCredential works as-is while the core SecretClient example uses require_envvar=True; examples rely on placeholders, lack version constraints and execution evidence, and leave several edge and failure modes unexplained. Static calibration caps this below 10.

Triggers, audience, and primary scenarios are reasonably clear, covering secrets, keys, certificates, cryptographic operations, and async usage, with references separating secondary scenarios. Points are deducted because non-fit boundaries, environment prerequisites, permission-model differences, and version boundaries are not explicit; there is no Chinese-language guidance or mainland-China reachability/region analysis.

The skill uses progressive sections for installation, authentication, domain examples, error handling, best practices, and references. It includes MIT licensing, Microsoft authorship, version 1.0.0, and package metadata, while repository README and CI provide some governance evidence. Points are deducted because the skill lacks a changelog, explicit maintainer and update path, FAQ, dependency versions, and a clear limitations section; references still require users to verify current APIs themselves.

The material can directly support common Key Vault Python SDK tasks, including secrets, keys, certificates, cryptography, deletion and recovery, and async clients. Points are deducted because URLs, names, permissions, and authentication environment must be supplied by the user, no verified end-to-end output is shown, and secret printing, purge examples, and possible API-version uncertainty can require substantial review. Static calibration caps this below 7.

The files provide concrete package names, classes, environment variables, code samples, reference indexes, and repository-level test/CI evidence, giving a modest audit trail. Points are deducted because the supplied tests are not skill-specific execution evidence, and there are no shown Key Vault path tests, pinned dependencies, real outputs, or independent corroboration; static reading cannot establish that the snippets run. Static calibration caps this below 5.