| name | blob-reader |
| description | Download a blob (CSV, JSON, or any file) from Azure Blob Storage using the caller's (agent's) managed identity via AAD — no account key or SAS. Use when an agent needs to read input data a user placed in their own blob container, including from inside a managed harness or sandbox where DefaultAzureCredential resolves to the agent identity. Requires the identity to hold the 'Storage Blob Data Reader' role on the container or account. |
Blob Reader
Overview
Download a blob from Azure Blob Storage authenticated with an AAD bearer token (the
caller's identity), not an account key or SAS. The bundled scripts/read_blob.py is
stdlib-only (no pip installs) so it runs on a bare Python image such as a harness sandbox.
In a managed harness the agent's managed identity is used automatically via
DefaultAzureCredential.
Prerequisites
HOLDINGS_BLOB_URL (or --url) — the full blob URL,
https://<account>.blob.core.windows.net/<container>/<blob>.- A token — resolved automatically:
--token / STORAGE_TOKEN env, then
DefaultAzureCredential, then az account get-access-token. Scope is
https://storage.azure.com/.default.
- RBAC: the identity must have Storage Blob Data Reader on the container or account
(role id
2a2b9908-6ea1-4ae2-8e65-a410df84e7d1). A 401/403 means the role is missing.
Usage
export HOLDINGS_BLOB_URL="https://<account>.blob.core.windows.net/<container>/holdings.csv"
python scripts/read_blob.py --out ./holdings.csv
Key rules
- 401/403 = missing role, not transient — report it plainly and stop; do not retry.
- 404 = wrong URL (container/blob path). The URL is the container + blob path, not a SAS.
- Reads only; this skill never writes or deletes. Data-plane role, not control-plane.
