declarative-agent-developer
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [Official Tooling Integration]: The skill relies on the
@microsoft/m365agentstoolkit-clipackage. This is the official command-line interface provided by the vendor for managing M365 agent lifecycles, ensuring that operations like provisioning and deployment are conducted through trusted channels. - [Secure Credential Management]: The instructions provide clear guidance on handling sensitive information, specifically recommending the use of
.env.*.userfiles that are excluded from version control. This approach minimizes the risk of accidental credential exposure in public or shared repositories. - [Workspace Integrity Verification]: The skill implements a set of 'Workspace Gates' and a 'Detect → Inform → Ask' protocol. These internal checks ensure the agent validates the execution environment before making changes, preventing unauthorized file creation or modifications in non-agent projects.
- [Standardized Network Operations]: Network-based tasks, such as OAuth endpoint discovery and MCP tool identification, follow standard protocol handshakes. These operations are essential for the skill's primary function of integrating external services and do not involve suspicious data exfiltration or unauthorized access patterns.
- [Instructional Integrity]: The inclusion of an 'Instruction Review' guide helps maintain the quality and safety of agent prompts, specifically addressing anti-patterns like tool description duplication and output-focused instructions that could lead to unexpected behavior.
Audit Metadata