declarative-agent-developer
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [Command Line Execution]: The skill utilizes the official Microsoft Agents Toolkit (ATK) CLI and standard shell utilities to scaffold, provision, and deploy projects. These operations are necessary for the skill's intended purpose as a developer tool.
- [External Content Ingestion]: The skill fetches and processes external data, such as OpenAPI specifications and MCP tool definitions, from user-provided URLs. While this involves processing untrusted content, the skill includes mandatory 'Detect → Inform → Ask' protocols to ensure user oversight and validation before any files are modified or deployed. (Ingestion points: Remote URLs; Boundary markers: Explicit instructions to warn users and wait for confirmation; Capability inventory: CLI execution and file system access; Sanitization: Built-in JSON parsing and schema validation checks).
- [Network Communication]: The skill uses network utilities like
curlto discover authentication metadata and perform handshakes with remote MCP servers. These operations are restricted to configuration discovery and do not involve unauthorized access to or exfiltration of sensitive local data. - [Dependency Management]: The skill references common Node.js packages, including
jimpfor image manipulation andmcp-remotefor protocol handling. These dependencies are standard for the development tasks described and are managed through established package registries.
Audit Metadata