m365-agents-dotnet
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install official Microsoft .NET packages via NuGet (e.g., Microsoft.Agents.Hosting.AspNetCore, Microsoft.Agents.Authentication.Msal). These packages are hosted on the standard NuGet registry and originate from a trusted organization.
- [SAFE]: All external references point to official Microsoft documentation (learn.microsoft.com) and the verified Microsoft GitHub repository (github.com/microsoft/agents).
- [SAFE]: Configuration templates for appsettings.json correctly use curly-brace placeholders (e.g., {{ClientSecret}}) for sensitive credentials, preventing accidental hardcoding of secrets.
- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface in the OnMessageAsync handler, where user-supplied text from turnContext.Activity.Text is echoed back. This is the intended primary purpose of a chatbot framework and does not represent a malicious pattern in this context.
- Ingestion points: turnContext.Activity.Text in MyAgent class.
- Boundary markers: None (typical for basic agent samples).
- Capability inventory: Sending messages back to the user via turnContext.SendActivityAsync.
- Sanitization: None (standard for boilerplate echo agents).
Audit Metadata