declarative-agent-developer

SUSPICIOUS. The core M365 agent-development functions are coherent, and `wiqd` appears officially tied to Microsoft, but the skill also instructs the agent to execute a third-party auth helper (`mcp-remote`), read cached OAuth tokens from disk, and reuse them in direct network calls. That credential-handling and supply-chain footprint is broader and riskier than a typical build/deploy guide, so overall risk is high even without confirmed malware.

This fragment appears to describe a legitimate MCP plugin-generation workflow, but it contains high-impact operational instructions rather than ordinary application logic. The main security concern is credential and data handling: it reads OAuth tokens from the local filesystem and sends them to a configurable remote MCP endpoint, while also executing an unpinned npm package through npx and trusting remotely supplied tool metadata. No definitive malware payload or destructive behavior is present in the visible fragment, but the workflow is unsafe if the MCP URL, npm package, or surrounding instructions are untrusted. Review the complete file and ensure package versions, endpoint allowlists, token permissions, temporary-file permissions, and user consent are enforced.