The Agent Skills Directory

Command Execution: The skill utilizes npx to execute the @microsoft/m365-copilot-eval CLI. This approach is a standard method for running developer tools and targets an official package provided by the vendor.
Secret Management: The instructions include clear guidance on managing sensitive information like API keys and tenant IDs. It recommends the use of local environment files (.env.local.user) and provides explicit warnings against including these secrets in version control or displaying them in terminal output.
External Resource Verification: The skill references official documentation and schemas. These references are from well-known and established sources, aligning with secure development practices.
Controlled Data Processing: While the skill involves reading and analyzing evaluation results, it includes specific guardrails to protect user privacy. It instructs the agent to avoid summarizing or displaying potentially sensitive content from result files unless specifically requested and confirmed by the user.
Indirect Prompt Injection Surface Analysis: This skill processes external data from evaluation result files, which is a standard requirement for its analytical functions. Ingestion points: Data enters the agent's context from evals/evals.json and .evals/results.json. Boundary markers: The skill relies on structured JSON parsing and specific instructions to only analyze relevant score keys, rather than processing the entire file as a single prompt. Capability inventory: The primary capability is the execution of the evaluation CLI via npx. Sanitization: The skill includes extensive guardrails in the documentation to prevent the accidental exposure or commitment of sensitive data found within these files.

m365-agent-evaluator