make-ai-teammate

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly directs the agent to read secrets (e.g., agentBlueprintClientSecret / clientId / tenantId) from a365.generated.config.json and copy them into .env/appsettings (i.e., verbatim credential propagation / copy‑paste), which requires the LLM to handle secret values directly and risks exfiltration.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill deliberately adds workspace auto-approval rules and background task wiring that allow chat agents to run shell/CLI commands without interactive prompts, and it enables telemetry that captures sensitive prompts/responses and propagates blueprint secrets into env files — together these are intentional behaviors that create high-risk avenues for remote command execution and sensitive data exposure/exfiltration if misused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime fetching/execution of remote code: it runs a git clone from https://github.com/microsoft/Agent365-Samples.git to scaffold sample code at runtime (which is later installed/run), and it includes a curl -sL https://aka.ms/DevTunnelCliInstall | bash install command for devtunnel that pipes a remote script to bash.