azure-copilot
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from the official Microsoft documentation site (
learn.microsoft.com). These references are used to provide the agent with context for troubleshooting, architecture, and configuration tasks. This behavior is consistent with the skill's stated purpose and targets a well-known, trusted domain. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external URLs via tools like
mcp_microsoftdocs:microsoft_docs_fetchorWebFetch. While this creates an ingestion point for external content, the risk is mitigated by the use of highly trusted official sources. - Ingestion points: External content is fetched from
https://learn.microsoft.com/en-us/azure/copilot/*based on user queries. - Boundary markers: The skill does not explicitly define delimiters for the fetched content.
- Capability inventory: The skill is primarily informational and does not contain scripts that perform automated file writes or command execution based on the fetched content.
- Sanitization: No explicit sanitization or validation steps are mentioned in the skill instructions.
Audit Metadata