Versioned security assessment

Report ID: SA-85BB02DB

7/5/2026, 8:50:43 PM

agent-framework security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
agent-framework
Version
v3
Maintainer
microsoft
Source
github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/microsoft-foundry/foundry-agent/create/agent-framework
Coverage
7 Files scanned · 785 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The reviewed files are mostly Markdown guidance and code samples, and most static hits are false positives from formatting, Python imports, or loopback debug addresses. Confirmed risks remain around .env handling, generated debug shell tasks, runtime package installation, and an unpinned npx MCP sample. No prompt injection attempt was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

7 Files scanned · 785 Lines analyzed

10 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 28 evidence locations

Capability review items (7)
Medium
references/debug-setup.md:90-119
Ruby/shell backtick execution
// use `${command:python.interpreterPath}` to point to current user's python env
The VS Code task template uses a shell command to run debugpy, agentdev, and the generated entrypoint. It is legitimate debugging support, but it is real command execution.
Medium
references/debug-setup.md:119-147
Ruby/shell backtick execution
// use `${command:python.interpreterPath}` to point to current user's python env
The alternate VS Code task template runs the selected Python interpreter with debugpy and the entrypoint. This is expected debug behavior, but it executes local code.
Medium
SKILL.md:139
Ruby/shell backtick execution
1. Run the main entrypoint using the venv's Python (e.g., `.venv/Scripts/python main.py` on Windows,
The skill instructs the agent to run the generated main entrypoint with the virtual environment Python during verification. That is real local code execution and should require user awareness.
Medium
SKILL.md:159
Ruby/shell backtick execution
| `ModuleNotFoundError` | Missing SDK | Run `pip install agent-framework-azure-ai==1.0.0b260107` in
The troubleshooting table recommends running pip install for a pinned Agent Framework package. The command is legitimate, but it installs external dependencies.
Low
references/agent-as-server.md:49
dotenv library
- If loading env variables from `.env` file, like `load_dotenv()`, make sure set `override=True` to
The guidance recommends loading configuration from a .env file with override enabled. This is legitimate setup guidance, but it can let local file values shadow trusted environment variables.
Low
references/agent-as-server.md:49
Python dotenv loader
- If loading env variables from `.env` file, like `load_dotenv()`, make sure set `override=True` to
The line explicitly references Python dotenv loading with override=True. It is a real environment configuration behavior and should be disclosed and controlled.
Low
references/agent-samples.md:36
Hardcoded URL
url="https://learn.microsoft.com/api/mcp",
The sample hardcodes the Microsoft Learn MCP endpoint, so generated code may make external network calls. The endpoint is transparent and official, but the network behavior is real.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
references/agent-as-server.md:49
Environment file access
- If loading env variables from `.env` file, like `load_dotenv()`, make sure set `override=True` to
The reference recommends load_dotenv(override=True), which can override deployed environment settings from a local .env file. That creates a sensitive configuration integrity risk.
RISK-002 High
SKILL.md:93
Environment file access
**ALWAYS create/update `.env` file**:
The instruction says to always create or update a .env file with project values. This can overwrite existing local configuration and persist environment data unexpectedly.
RISK-003 High
references/agent-samples.md:27-31
Unpinned MCP Tool Execution
The MCP tools sample runs npx with @playwright/mcp@latest. This can download and execute the latest package at runtime without a reviewed pinned version.
The sample explicitly sets command="npx" and args with -y and @playwright/mcp@latest. This is a clear unpinned external package execution pattern.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Environment file handling
    Do not always overwrite .env. Preserve existing values, ask for confirmation, and document that load_dotenv(override=True) can shadow deployment variables.
  2. FIX-002
    High
    Unpinned MCP package execution
    Pin @playwright/mcp to a reviewed version or require user confirmation before generating npx -y @latest commands.
  3. FIX-003
    Medium
    Generated shell debug tasks
    Generate VS Code shell tasks only after the user confirms the entrypoint and ports. Keep debugpy bound to localhost.
  4. FIX-004
    Medium
    Autonomous startup verification
    Ask before running generated apps or installing dependencies. Separate code generation from execution in default workflows.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
High
references/agent-as-server.md:67
LLM role tokens injection
if message.role == Role.ASSISTANT:
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable