install-atk
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Official Package Download and Execution: The skill uses
npxto download and run the@microsoft/m365agentstoolkit-clipackage. This is a common and legitimate method in Node.js development to ensure the latest version of a tool is used without requiring a permanent global installation. - VS Code Extension Installation: The skill automates the installation of the
TeamsDevApp.ms-teams-vscode-extension. This uses the official Visual Studio Code CLI (code --install-extension) to fetch the extension from the marketplace, which is consistent with the skill's objective to set up the toolkit. - Environment Variable Configuration: The
export ATK_CLI_SKILL=truecommand is used for telemetry tagging. This allows the toolkit to identify that commands are being run within the context of the AI agent skill, a routine practice for developer tool analytics.
Audit Metadata