The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/auth_dynamics.py uses subprocess.run to invoke the Azure CLI (az) for logging in and retrieving access tokens. These calls are performed without a shell and target an official Microsoft tool.
[EXTERNAL_DOWNLOADS]: The skill performs HTTP POST requests to login.microsoftonline.com using the standard urllib.request library. This is used exclusively for refreshing OAuth2 tokens via the official Microsoft identity platform.
[DATA_EXFILTRATION]: The skill reads and writes to specific local files to manage token state, including ~/.dynamics/token.json, ~/.OpenDataverse/config.json, and a local token.json. This behavior is consistent with its stated purpose of managing Dynamics 365 authentication caches.
[CREDENTIALS_UNSAFE]: While the skill handles sensitive bearer tokens, it treats them as secrets. It includes explicit instructions for the AI agent to avoid printing or sharing tokens unless requested by the user. The hardcoded client ID 51f81489-12ee-4a9e-aaae-a2591f45987d is a well-known public client ID for Microsoft Power Platform and does not constitute a secret exposure.

auth-dynamics