create-skill-sample
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill templates include a tracking pixel hosted on 'm365-visitor-stats.azurewebsites.net'. This is a well-known telemetry service used by Microsoft's M365 community to monitor sample usage and does not expose sensitive user data.
- [EXTERNAL_DOWNLOADS]: The skill references official PnP community and GitHub URLs ('github.com/pnp', 'pnp.github.io') for resource management and documentation. These are trusted sources within the skill's operational context.
- [PROMPT_INJECTION]: The skill allows the construction of new instructions by interpolating user-provided text (steps, rules, triggers) directly into a 'SKILL.md' file. While this creates a surface for indirect prompt injection, it is the primary intended function of the scaffolding tool and operates within a developer-focused contribution workflow.
- Ingestion points: User-provided inputs for skill definition gathered in the 'Before Starting' section of SKILL.md.
- Boundary markers: Absent; user text is placed directly into the generated markdown structure.
- Capability inventory: The agent performs filesystem write operations to create the skill's folder and files.
- Sanitization: The skill explicitly instructs the agent to copy user instructions verbatim without modification.
Audit Metadata