typespec-create-agent
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured template and guidelines for creating Microsoft 365 Copilot agents using official TypeSpec decorators.
- [SAFE]: The dependencies referenced in the code snippets (such as
@microsoft/typespec-m365-copilot,@typespec/http, and@typespec/openapi3) are well-known, official libraries from Microsoft. - [INDIRECT_PROMPT_INJECTION]: The skill provides a template that interpolates user-provided instructions into an agent definition, creating a potential attack surface for indirect prompt injection if the user provides malicious content during the generation process.
- Ingestion points: User input defining the agent's purpose, role, and behavioral guidelines via the 'Examples' workflow in SKILL.md.
- Boundary markers: The template uses triple-quoted strings for the
@instructionsdecorator, which provide basic structural separation for the injected content. - Capability inventory: The generated agent can be configured with powerful capabilities including
Email,OneDriveAndSharePoint,Meetings, andCodeInterpreter. - Sanitization: No explicit sanitization or validation of the user-provided text is performed or described in the skill's instructions.
Audit Metadata