microsoft-build
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Official CLI Tooling: The skill utilizes
npxto execute the@microsoft/events-cliand@microsoft/learn-clitools. These are official packages provided by the vendor to fetch and search event catalogs and documentation locally. - Local Project Interaction: To provide relevant recommendations, the skill reads common project metadata files such as
package.jsonandrequirements.txt. This access is appropriate for identifying the user's technology stack. - Defensive Data Handling: The skill processes external content from event catalogs and announcements. It includes explicit safety instructions for the agent to treat this content as untrusted data and to ignore any embedded commands, effectively mitigating potential indirect prompt injection risks.
- Project Scaffolding and Logging: The skill supports creating starter projects and recording session notes in a local journal. These operations are performed in response to explicit user requests and align with the intended developer-focused functionality.
Audit Metadata