Versioned security assessment

Report ID: SA-0686278E

6/30/2026, 7:49:39 AM

agent-framework security assessment v2

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: agent-framework
Version: v2
Maintainer: microsoft
Source: github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/microsoft-foundry/foundry-agent/create/agent-framework
Coverage: 7 Files scanned · 785 Lines analyzed
Policy version: Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many command, network, environment, and blocker patterns, including a critical combined heuristic. Review found the highest-severity matches are mostly Markdown examples, SDK role constants, localhost debug settings, and package install guidance. The skill is publishable with a medium warning because generated projects can run tools and write local configuration.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 785 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 3 evidence locations

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 2 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Capability review items (4)

Medium

references/agent-samples.md:27-31 references/debug-setup.md:51-62 references/debug-setup.md:89-120

External Tool Execution in Generated Projects

The skill can scaffold MCP and debug patterns that run external tools, including an npx-based Playwright MCP server and Python debug commands. This is legitimate for agent development, but it creates supply-chain and local execution risk if users run generated projects without review.

The cited examples directly configure commands that a generated project may execute. The intent is normal developer tooling, so confidence is high for operational risk but not malicious intent.

Medium

SKILL.md:93-100 references/agent-as-server.md:49

Environment File Creation and Override Guidance

The skill instructs assistants to always create or update a .env file with Foundry project settings. It also recommends load_dotenv override behavior. The shown values are project configuration rather than secrets. Automatic environment-file edits can affect deployed behavior and expose sensitive local configuration.

There is direct evidence of .env writing guidance and dotenv override guidance. The examples do not show credential exfiltration, so the concern is configuration handling rather than confirmed secret theft.

Low

references/debug-setup.md:56-62 references/debug-setup.md:73-157

Local Debug Server Commands Are Benign but Powerful

The debug setup includes shell tasks that start local HTTP and debugpy listeners on localhost ports. The static hardcoded IP and command findings are mostly expected for VS Code debugging, but users should confirm ports and commands before running generated tasks.

The commands and addresses are visible and bound to local development usage. They are not evidence of remote exfiltration, but they do start local services.

Low

references/agent-samples.md:33-37 references/workflow-foundry.md:21-23 references/debug-setup.md:56-62

Official and Local Network References

Network findings point to Microsoft Learn MCP, placeholder Foundry endpoints, and localhost debug ports. No evidence found of unknown external collection endpoints or suspicious data transfer.

The cited network targets are official documentation, placeholders, or loopback addresses. This strongly supports a false positive for malicious networking.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)

Low

SKILL.md:3-6 references/agent-as-server.md:63-74 references/workflow-basics.md:11-24

Static Blocker Matches Are False Positives

The weak cryptography, system reconnaissance, and role-token findings are not confirmed in context. Cited lines contain Markdown metadata, SDK examples, role enum usage, version pinning, or agent name validation guidance rather than cryptographic code, reconnaissance, or prompt injection.

Manual review found no matching dangerous operation at these cited locations. The patterns appear to be scanner confusion from Markdown text and SDK terminology.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable