install-atk
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- External Package Download and Execution: The skill uses
npxto fetch and run the@microsoft/m365agentstoolkit-clipackage. This mechanism is used to ensure the latest version of the toolkit is used for CLI operations without requiring a persistent global installation. - Command Line Interaction: The instructions include commands to install a VS Code extension (
TeamsDevApp.ms-teams-vscode-extension) and verify the CLI environment. These operations are necessary for the skill's primary task of environment configuration. - Indirect Prompt Injection Surface: The skill processes user requests (e.g., "install atk") to determine which installation steps to perform. This creates a surface where user input influences the sequence of commands executed, though the commands themselves are hardcoded to specific official resources.
Audit Metadata