agent-framework-azure-ai-py
Fail
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install
agent-frameworkandagent-framework-azure-aivia pip using the--preflag. These package names do not align with official Microsoft Azure AI Foundry SDK namespaces (which typically useazure-ai-*), suggesting potential dependency confusion or typosquatting. - [REMOTE_CODE_EXECUTION]: By recommending the installation of unverifiable pre-release packages from a public registry, the skill could lead to the execution of arbitrary malicious code on the user's machine during the installation or import process.
- [PROMPT_INJECTION]: The skill defines an architecture for persistent agents that ingest data from external sources via
HostedWebSearchToolandMCPStreamableHTTPTool. This configuration is vulnerable to indirect prompt injection attacks because it lacks sanitization and explicit boundary markers to separate untrusted tool outputs from system instructions. - Ingestion points: Data enters the agent context through
agent.run()and external tool outputs (Bing search, MCP endpoints). - Boundary markers: None identified in the provided implementation examples to delimit external content.
- Capability inventory: The skill provides the agent with high-privilege capabilities including code execution (
HostedCodeInterpreterTool) and network access. - Sanitization: The implementation does not include any validation or escaping for the data returned by hosted tools before processing.
Recommendations
- AI detected serious security threats
Audit Metadata