M365 Declarative Agent Debugging Skill
Audited by Socket on Mar 10, 2026
1 alert found:
Obfuscated FileThe skill is coherently scoped as a debugging/validation helper for M365 Declarative Agent schemas and assets. Its footprint—reliance on npm/npx for tooling, checks against schema versions, asset validations, and a cautiously described OneDrive memory read flow—appears appropriate to its stated purpose. No obvious credential harvesting or malicious data exfiltration patterns are described; data access is user-controlled (OneDrive memory flow) with explicit validation steps. Some data flow considerations exist around memory access via OneDrive shared folders, which warrants careful permission scoping and user consent in practice. Overall, the risk posture is benign-to-low with potential medium risk if data exposure pathways are not properly consented or scoped.