m365-agents-py
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions define an agent that processes untrusted data from users (via
context.activity.text) and external APIs (such asuser_info['displayName']) without explicit sanitization or boundary delimiters. This creates a surface for indirect prompt injection where malicious instructions embedded in that data could influence the agent's behavior. - Ingestion points: Message text from conversational activities and user profile data retrieved from the Microsoft Graph API.
- Boundary markers: None identified in the provided code examples to separate instructions from data.
- Capability inventory: The agent has network access via the
aiohttpandopenailibraries to perform API calls and stream data. - Sanitization: No input validation, filtering, or output escaping is demonstrated in the provided code snippets.
- [SAFE]: The skill utilizes official Microsoft SDK components and integrates with well-known services such as Azure OpenAI and Microsoft Graph using standard authentication flows (MSAL).
- [SAFE]: The documentation provides guidance on secure secret management, correctly recommending the use of environment variables to store sensitive credentials such as client secrets and API keys rather than hardcoding them in source code.
Audit Metadata