dv-overview
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- Environment Confirmation Requirement: The skill implements a mandatory safety check requiring the agent to display the target environment URL and obtain explicit user confirmation before any modifications occur. This practice helps prevent accidental changes to incorrect or production environments.
- Credential Safety Best Practices: Instructions explicitly forbid hardcoding credentials or reading raw token cache files. Instead, it mandates using managed authentication through official Microsoft libraries and CLI authentication profiles, which is a standard security best practice.
- Standard Toolchain Enforcement: To ensure a predictable and secure execution environment, the skill restricts automation logic to Python and specific official CLIs, explicitly forbidding the use of Node.js or unofficial authentication flows for these tasks.
- Telemetry and Attribution: The skill incorporates deterministic telemetry headers for server-side attribution of OData calls. The instructions specify this uses a closed schema designed to exclude Personally Identifiable Information (PII).
- Indirect Prompt Injection Surface: Like most agent skills, this skill processes external data such as environment metadata and user instructions. It includes guidelines to prevent the agent from generating unsupported paths or endpoints based on untrusted input.
Audit Metadata