skills/microsoft/skills/install-atk/Gen Agent Trust Hub

install-atk

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • External Package Download and Execution: The skill uses npx to fetch and run the @microsoft/m365agentstoolkit-cli package. This mechanism is used to ensure the latest version of the toolkit is used for CLI operations without requiring a persistent global installation.
  • Command Line Interaction: The instructions include commands to install a VS Code extension (TeamsDevApp.ms-teams-vscode-extension) and verify the CLI environment. These operations are necessary for the skill's primary task of environment configuration.
  • Indirect Prompt Injection Surface: The skill processes user requests (e.g., "install atk") to determine which installation steps to perform. This creates a surface where user input influences the sequence of commands executed, though the commands themselves are hardcoded to specific official resources.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 11:50 AM
Security Audit — agent-trust-hub — install-atk