m365-agents-py
Verdict safe, but 1 finding (1 medium), mainly data exfiltration. Most recent scan 2026-02-05.
The Microsoft 365 Agents SDK skill is a legitimate development framework skill with MEDIUM security concerns primarily around credential management practices. The skill provides instructions for building enterprise agents using Microsoft's official SDK packages. The main security issue is the lack of guidance on secure credential storage - the skill shows sensitive values (client secrets, API keys) being loaded from .env files without warnings about production security practices. The skill has no executable scripts (only instructions), no prompt injection attempts, no data exfiltration code, and no malicious behavior. The referenced files are mostly missing but appear to be legitimate Python standard library modules and Microsoft SDK components. The code example is truncated but shows standard Microsoft SDK usage patterns. Missing optional metadata (allowed-tools, license, compatibility) represents minor documentation gaps rather than security threats.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Microsoft 365 Agents SDK for Python. Build multichannel agents for Teams/M365/Copilot Studio with aiohttp hosting, AgentApplication routing, streaming responses, and MSAL-based auth. Triggers: "Microsoft 365 Agents SDK", "microsoft_agents", "AgentApplication", "start_agent_process", "TurnContext", "Copilot Studio client", "CloudAdapter".
- Package
- 2 files, 21 KB
- SKILL.md
- 916 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Microsoft 365 Agents SDK (Python) · Before implementation · Important Notice - Import Changes · Installation · Environment Variables (.env) · Optional: OAuth handlers for auto sign-in · Optional: Azure OpenAI for streaming · Optional: Copilot Studio client · Core Workflow: aiohttp-hosted AgentApplication · Enable logging · Load configuration · Create storage and connection manager
Findings
MEDIUM Hardcoded Secrets Risk in Environment Variable Configuration Data Exfiltrationllm
The skill instructs users to store sensitive credentials (client secrets, API keys, tenant IDs) in .env files without guidance on secure storage practices. The example configuration shows CLIENTSECRET, AZURE_OPENAI_API_KEY, and other sensitive values being loaded directly from environment variables without encryption or secure vault integration. While using .env files is common in development, the skill provides no warnings about production security or credential rotation.
SKILL.md
CONNECTIONS__SERVICE_CONNECTION__SETTINGS__CLIENTSECRET=<client-secret>
AZURE_OPENAI_API_KEY=<key>What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 12 KB |
references/acceptance-criteria.md | doc | 8.9 KB |
External hosts referenced
github.com learn.microsoft.com pypi.org api.powerplatform.com graph.microsoft.com login.microsoftonline.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit cfbcbbdc679c. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/microsoft/agent-skills
- Raw scan result: github-skills-m365-agents-py-scan.json
- Badge for your README:
- Request a re-scan