add-teams
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches and executes code from several external sources:
- Package Managers: Installs '@chat-adapter/teams' via pnpm and '@microsoft/teams.cli' via npm from the official registry.
- Version Control: Downloads source code and tests from the project's 'channels' branch using git.
- [COMMAND_EXECUTION]: The installation and configuration process relies on executing various shell commands:
- Resource Management: Uses 'az' (Azure CLI) to create resource groups and bot registrations.
- Teams Management: Uses 'teams' CLI for app creation and authentication.
- Development Tools: Executes 'git', 'pnpm', and 'npm' for code retrieval, build processes, and testing.
- Service Control: Employs 'launchctl' and 'systemctl' to restart the agent services after installation or removal (as seen in REMOVE.md).
- [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by enabling the agent to ingest data from Microsoft Teams.
- Ingestion points: The agent receives and processes messages from Teams via the adapter defined in 'src/channels/teams.ts'.
- Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from obeying commands embedded within Teams messages.
- Capability inventory: The agent environment includes access to powerful CLI tools such as 'git', 'pnpm', 'npm', and 'az', which could be targeted if an injection occurs. These capabilities are documented across 'SKILL.md' and 'REMOVE.md'.
- Sanitization: The setup instructions do not specify any sanitization or validation logic for the incoming message payloads.
Audit Metadata