teams-sdk-to-agents-sdk-dotnet-migration
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- External Resource Resolution: The skill fetches release history and version information from Microsoft's official GitHub repository and the NuGet registry. These are well-known, trusted services used to ensure the latest stable SDK versions are applied.
- Sensitive Configuration Management: The instructions include security best practices for handling credentials. Specifically, it guides the use of placeholders in the primary configuration and recommends the use of environment variables or git-ignored development settings files to prevent accidental credential leakage.
- Indirect Prompt Injection Surface: As this skill facilitates the creation of a conversational agent, the resulting application will process external data (user messages).
- Ingestion points: Untrusted data enters the agent context via the
turnContext.Activity.Textproperty in theAgentApplicationsubclass. - Boundary markers: The skill does not explicitly define message delimiters, as its primary focus is structural code migration.
- Capability inventory: The migrated agent has capabilities to send activities, interact with the Microsoft Teams API, and access the Microsoft Graph API.
- Sanitization: The skill relies on the standard type-safe models provided by the Microsoft Agents SDK to handle incoming payloads.
- Vendor-Owned Dependencies: The skill identifies several official Microsoft SDK packages (e.g.,
Microsoft.Agents.Hosting.AspNetCore) as necessary replacements. These are verified vendor resources aligned with the skill's migration purpose.
Audit Metadata