a365-code-validator
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFE
Full Analysis
- Support-Safe Redaction Policy: The skill implements a strict policy to redact sensitive information such as internal infrastructure names, tenant IDs, and agent identifiers from its validation reports. This design choice helps mitigate the risk of accidental data exposure when sharing logs or reports for support purposes.
- Vendor-Aligned Tooling and Dependencies: All referenced libraries (e.g.,
microsoft-opentelemetry,@microsoft/opentelemetry) and CLI utilities (e.g.,a365) are official resources from the vendor. This alignment with the vendor's own ecosystem reduces the potential for third-party supply chain risks. - Controlled Code Remediation: The skill possesses capabilities to modify code, which is a potential security consideration. However, this is limited to deterministic, low-risk changes and strictly requires user confirmation via a prompt before any edits are performed. It also explicitly avoids modifying sensitive security configurations such as Blueprint permissions.
- Transparent Static Analysis Runner: The included validation runner (
a365-code-validator.js) is a standalone Node.js script that performs targeted pattern matching on the local project files. It does not utilize dynamic code execution or perform network operations, ensuring that the validation process remains isolated and predictable.
Audit Metadata