The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of several packages via npm. All listed packages (e.g., @microsoft/agents-hosting, @microsoft/agents-copilotstudio-client, ai, and @ai-sdk/azure) are official libraries from Microsoft or well-known organizations like Vercel (AI SDK). These are standard dependencies for the claimed purpose of building M365 agents.
[CREDENTIALS_UNSAFE]: The documentation includes a list of required environment variables such as AZURE_API_KEY, CLIENT_SECRET, and COPILOT_BEARER_TOKEN. However, it correctly uses placeholders (e.g., <azure-openai-key>, <client-secret>) and explicitly instructs the user in the 'Best Practices' section to keep secrets out of source code and load them from environment variables or secure stores.
[INDIRECT_PROMPT_INJECTION]: The skill processes incoming messages via agent.onMessage. It includes a security warning that "Incoming activities are untrusted and must not authorize arbitrary tool use, secret disclosure or messages to unrelated recipients," which is a recommended defensive practice against indirect prompt injection.
[COMMAND_EXECUTION]: The skill provides standard npm install commands to set up the development environment. No arbitrary or suspicious shell commands were detected.

m365-agents-ts