teams-app-manifest
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes external source code, configuration files, and README documentation to determine the required capabilities for a Teams app manifest. This represents a data ingestion surface where specific patterns in the analyzed files could influence the resulting manifest permissions. The skill includes design features to manage this, such as a strict authority order, schema validation, and a requirement to stop and ask the user for clarification on security-sensitive values.
- Trusted External References: The skill utilizes official documentation and schemas from established domains to validate manifest structure and features. These references are used appropriately for technical verification.
Audit Metadata