azure-hosted-copilot-sdk
Pass
Audited by Gen Agent Trust Hub on May 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill scaffolds projects using the 'azd init' command targeting the 'azure-samples' organization on GitHub, which is a trusted and well-known source for official Azure application templates.
- [COMMAND_EXECUTION]: Standard development tools such as 'azd', 'gh', and 'docker' are used for legitimate workflows, including project initialization, credential management, and application testing.
- [PROMPT_INJECTION]: As the skill involves processing codebase markers and guiding the development of AI-driven chat features, it presents an indirect prompt injection surface. This risk is mitigated through comprehensive instructions on secure authentication and identity management.
- [SAFE]: The skill emphasizes the use of passwordless connections and Managed Identities for production environments, steering users away from hardcoded secrets and toward industry-standard security practices.
Audit Metadata