API MANAGEMENT / Microsoft
API Management SDK
Pins Microsoft's API Management Python skill, which requires DefaultAzureCredential and rejects connection strings and API keys for the management client.
“Azure API Management SDK for Python. Use for managing APIM services, APIs, products, subscriptions, and policies. Triggers: "azure-mgmt-apimanagement", "ApiManagementClient", "APIM", "API gateway", "API Management". ”
01 / THE REASONING
Why this made the selection.
- The file says to prefer DefaultAzureCredential for the management client and to avoid connection strings, account keys, and API keys.
- It says local development can use that credential as-is, while production must constrain the chain with AZURE_TOKEN_CREDENTIALS, and it requires context-manager cleanup.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- .github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md
- README.md
- .github/plugins/azure-sdk-python/README.md
- LICENSE
Our findings
- The file prefers DefaultAzureCredential and says it works locally as-is and in Azure without a code change.
- It says to avoid connection strings, account keys, and API keys because they bypass Entra audit and rotation.
- Production use must set AZURE_TOKEN_CREDENTIALS to prod or a named credential so the credential chain is constrained.
- Clients and async credentials must be context managers so transports and token caches are released.
- The shown constructor is DefaultAzureCredential() with no extra flag, which matches the local as-is rule.
Not established by this review
- The resource was not executed.
- No API Management resource was created and no subscription key was read.
- The referenced capabilities and non-hero scenario files were not opened.
- The azure-sdk-python plugin was not installed.
- Not executed: it was not installed or run.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin install azure-sdk-python@skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The azure-sdk-python plugin README shows `/plugin install azure-sdk-python@skills`. That installs the plugin group, not this one file.
- The same README shows `npx skills add microsoft/skills --skill azure-sdk-python`, which adds that plugin pack from the repository.
- The repository README shows `/plugin marketplace add microsoft/skills` and `/plugin install azure@skills` for a different plugin.
Before you start
- The skill's installation block names the packages azure-mgmt-apimanagement and azure-identity
- AZURE_SUBSCRIPTION_ID, which the skill marks required for every auth method
- AZURE_TOKEN_CREDENTIALS set to prod or a named credential when DefaultAzureCredential is used in production
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md
Supports: DefaultAzureCredential, rejection of key-based client auth, and context-manager cleanup
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/README.md
Supports: /plugin install azure-sdk-python@skills for the plugin group
- Repository README ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/README.md
Supports: Copilot CLI plugin install for a different azure plugin, and the MIT statement
- Repository LICENSE ↗Checked
https://github.com/microsoft/skills/blob/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/LICENSE
Supports: MIT License
https://raw.githubusercontent.com/microsoft/skills/fc164ba1d7a0c10377dbcc1c9ac07253b9329fdb/.github/plugins/azure-sdk-python/skills/azure-mgmt-apimanagement-py/SKILL.md
Supports: upstreamDescription, bestFor, review.reviewedAt, review.notTested