skills/microsoft/skills/skill-creator/Gen Agent Trust Hub

skill-creator

Pass

Audited by Gen Agent Trust Hub on May 27, 2026

Risk Level: SAFE
Full Analysis
  • [Authentication Patterns]: The skill correctly emphasizes using DefaultAzureCredential for local development and specific identity credentials (like ManagedIdentityCredential) for production. It explicitly warns against hardcoding credentials and provides language-specific implementation examples that follow Microsoft's security best practices.
  • [Resource Management]: The instructions mandate the use of context managers (with / async with) in generated code to ensure that HTTP connections and security tokens are deterministically closed and cleaned up.
  • [Infrastructure & Scripts]: The included Python scripts (init_skill.py, package_skill.py, quick_validate.py) are utility tools for skill development. They perform standard file system operations (creating directories, zipping files, YAML parsing) and do not contain network exfiltration or obfuscated code.
  • [Dependency Management]: The skill references official Azure SDK packages (e.g., azure-identity, azure-core, @azure/identity). In the Rust section, it provides specific guidance to use official azure_* crates rather than deprecated community alternatives, which helps prevent supply chain confusion.
  • [Environment Variable Usage]: The skill promotes the use of environment variables for endpoints and configuration, which is a standard and recommended practice for avoiding sensitive data exposure in source code.
Audit Metadata
Risk Level
SAFE
Analyzed
May 27, 2026, 04:15 AM
Security Audit — agent-trust-hub — skill-creator