m365-agents-dotnet
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions and code for building Microsoft 365 agents using official Microsoft.Agents packages.
- [COMMAND_EXECUTION]: Includes standard 'dotnet add package' commands for official Microsoft NuGet packages. These are well-known and expected for the skill's purpose.
- [DATA_EXPOSURE]: Uses safe placeholders (e.g., '{{ClientSecret}}') in configuration templates and correctly advises users in the 'Best Practices' section to use Key Vault or environment variables for production secrets. The error handler in 'SKILL.md' reflects exception messages to the user, which is a common pattern in development samples but is noted for potential information disclosure in production.
- [EXTERNAL_DOWNLOADS]: References official Microsoft documentation and the official Microsoft GitHub repository. These are well-known and trusted sources.
- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface where user input is processed.
- Ingestion points: 'turnContext.Activity.Text' in the 'MyAgent' class (SKILL.md).
- Boundary markers: Absent in the sample template.
- Capability inventory: 'SendActivityAsync' (messaging capability) is the only demonstrated capability.
- Sanitization: The sample reflects the input directly without sanitization, following standard SDK 'echo' examples.
Audit Metadata