azure-devops
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation resource for the Azure DevOps REST API, providing examples for common services like Boards, Repos, and Pipelines. It follows best practices for credential handling, using placeholders for tokens and encouraging the use of environment variables.
- [DATA_EXFILTRATION]: All referenced API endpoints target legitimate Azure DevOps domains (e.g., dev.azure.com, vsrm.dev.azure.com). The skill includes explicit warnings against hardcoding sensitive information and provides guidance on secure token management.
- [EXTERNAL_DOWNLOADS]: The skill recommends using official and established SDKs, such as the azure-devops Python package and the azure-devops-node-api library, which are appropriate for the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external data such as work items and pull requests.
- Ingestion points: Pull request threads, work items, and wiki pages (identified in repos-version-control.md, boards-work-tracking.md, and advanced-integrations.md).
- Boundary markers: Security guidelines and best practices sections advise on input validation and secure credential handling.
- Capability inventory: Includes build execution, repository file modification, and work item updates (identified in pipelines-cicd.md and repos-version-control.md).
- Sanitization: The documentation explicitly recommends input validation and least-privileged scoping as best practices for developers.
Audit Metadata