add-workiq-tools

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFE
Full Analysis
  • Standard CLI Integration: The skill uses the official a365 developer tool for listing and configuring MCP servers. These operations are restricted to the local development environment and manifest management.
  • Framework-Specific Wiring: The skill provide tailored code snippets for .NET, Node.js, and Python frameworks. These patterns use official Microsoft packages (e.g., Microsoft.Agents.A365.Tooling) and follow standard initialization practices for the respective SDKs.
  • Credential Handling Guidance: The skill correctly instructs developers to manage bearer tokens for local development using environment variables (.env, launchSettings.json) or temporary raw tokens via a365 develop get-token. It properly differentiates between local development tokens and production OAuth2 On-Behalf-Of (OBO) flows.
  • Permission Handoff Model: The skill implements a clear separation of concerns regarding security permissions. It identifies when Global Administrator action is required (a365 setup permissions mcp) to grant OAuth2 delegated scopes, rather than attempting to perform high-privilege actions autonomously.
  • Verification and Validation: The skill includes a post-wiring verification phase that runs standard build commands (dotnet build, npm run build, pip install) to ensure that changes do not introduce compilation errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 05:20 PM
Security Audit — agent-trust-hub — add-workiq-tools