m365-agents-ts
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install official packages from Microsoft's public registry (@microsoft/agents-hosting, @microsoft/agents-hosting-express, @microsoft/agents-activity, @microsoft/agents-copilotstudio-client).
- [DATA_EXPOSURE]: Properly demonstrates the use of environment variable placeholders for sensitive credentials such as Azure OpenAI keys and Microsoft Entra ID secrets, discouraging hardcoding of sensitive information.
- [PROMPT_INJECTION]: Identifies a standard input processing surface where user-provided text is passed to an LLM for response generation.
- Ingestion points: agent.onMessage handlers in SKILL.md.
- Boundary markers: Not present in the minimal code examples.
- Capability inventory: Network-based operations for streaming responses and activity delivery; no privileged file system or command execution detected.
- Sanitization: Standard SDK implementation; developers are encouraged to follow platform-specific sanitization guidelines for production deployments.
Audit Metadata