teams-adaptive-cards
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill instructions in SKILL.md and the reference files focus on technical implementation and design best practices. No attempts to bypass safety filters or override system instructions were found.
- [DATA_EXFILTRATION]: No network operations or credential harvesting patterns were detected. All external links point to official Microsoft documentation or generic placeholders (example.com).
- [REMOTE_CODE_EXECUTION]: The skill does not perform any remote script downloads or execution. It includes a local Node.js script (scripts/check-teams-card.mjs) designed for linting JSON payloads.
- [COMMAND_EXECUTION]: The provided Node.js script is a standard CLI tool that uses built-in modules (node:fs, node:path) to read and validate local files. It does not execute arbitrary shell commands or use unsafe functions like eval().
- [OBFUSCATION]: All instructions and code are provided in clear text. No hidden characters, Base64-encoded strings, or homoglyph substitutions were identified.
- [SAFE]: The skill follows best practices for Microsoft Teams development, including proper transport wrapping and versioning guidance. All referenced resources are within the expected domain of the skill's purpose.
Audit Metadata