Audit History

Most static alerts are false positives caused by Markdown fences, inline code, Python imports, and Python async context managers. The installation example presents one medium supply-chain risk because it installs unpinned prerelease packages.

AI review found the static findings to be false positives from Markdown formatting and Python documentation examples. No prompt injection, credential exfiltration, hidden execution path, or malicious network intent was found in SKILL.md.

The static findings are false positives caused by Markdown code fences, inline code formatting, Python examples, and sample Azure or Microsoft URLs. No prompt injection text, credential exfiltration intent, or automatically executed commands were found in the reviewed SKILL.md content.

Most static findings are false positives caused by Markdown fences, Python imports, and Python async context managers in documentation examples. The skill is still medium risk because it instructs users to configure hosted code execution, web search, and MCP network tools for Azure AI agents.

All 57 static findings are false positives. The skill contains only documentation and code examples for building Azure AI Foundry agents using the Microsoft Agent Framework Python SDK. The detected patterns (import statements, async context managers, markdown backticks, placeholder URLs) are legitimate documentation elements, not security risks.