microsoft-agent-framework
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the 'semantic-kernel' Python package and several 'Microsoft.SemanticKernel' .NET packages. These are official, well-known libraries from Microsoft used for AI orchestration.
- [COMMAND_EXECUTION]: A code snippet for a 'Calculator' tool uses the Python 'eval()' function to process mathematical expressions. While 'eval()' can be dangerous if used on untrusted input, the example is provided for educational purposes and explicitly includes a code comment advising the user to 'Use safe eval in production'.
- [PROMPT_INJECTION]: The skill defines system instructions for various agents (Researcher, Writer, Editor). These are standard task-oriented prompts and do not contain any instructions to bypass safety filters or override agent behavior.
- [DATA_EXFILTRATION]: The code samples demonstrate how to initialize AI services using variables for deployments and API keys. It follows best practices by not hardcoding credentials and does not attempt to access sensitive local files.
Audit Metadata