tune-copilot-teams-extension — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tune-copilot-teams-extension (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Aspect | Default | Optimized | Impact |
|---|---|---|---|
| Card complexity | 10+ elements | 5-7 elements | Faster render, better mobile |
| Image resolution | Original | 400px max width | Faster load |
| Action buttons | 5+ | 3 max (primary/secondary/dismiss) | Clearer UX |
| FactSet usage | Full details | Top 3-5 facts | Less scroll |
| Card version | 1.3 | 1.5 | Latest Teams features |
Card design rules:
wrap: true on all TextBlocks| Strategy | Before | After | Improvement |
|---|---|---|---|
| Individual calls | 5 calls × 200ms = 1s | — | Baseline |
Batch requests ($batch) | 1 call × 300ms | 70% faster | 700ms saved |
| Response caching (Redis) | — | Cache 5min TTL | 95% faster for repeated |
| Delta queries | Full data each time | Only changes | 80% less data |
| Select/expand fields | Return all fields | Only needed fields | 50% less payload |
# Example: Batch 3 Graph calls into 1
POST https://graph.microsoft.com/v1.0/$batch
{
"requests": [
{ "id": "1", "method": "GET", "url": "/me/profile" },
{ "id": "2", "method": "GET", "url": "/me/drive/recent" },
{ "id": "3", "method": "GET", "url": "/me/messages?$top=5" }
]
}| Parameter | Default | Range | Impact |
|---|---|---|---|
| System prompt length | 500 tokens | 200-800 | Shorter = faster, longer = more context |
| Temperature | 0.3 | 0.1-0.5 | Lower = more consistent, higher = more creative |
| Max response tokens | 500 | 200-1000 | Cards show summaries, link to details |
| Knowledge grounding | None | SharePoint/Dataverse | More accurate domain answers |
| Citation format | None | "[Source: doc name]" | User trust + verification |
| Strategy | Implementation | Benefit |
|---|---|---|
| Token caching | Store in Bot State (Cosmos DB) | Avoid re-auth on every message |
| Refresh proactively | Refresh at 80% of expiry | No failed calls from expired tokens |
| Scope minimization | Request only needed scopes | Faster consent, less risk |
| Conditional access | Handle MFA challenges gracefully | No broken flows for MFA users |
| Component | Cost Driver | Optimization |
|---|---|---|
| Bot Service | Messages processed | Free tier: 10K messages/mo |
| App Service | Compute hours | B1 tier sufficient for <1000 users |
| Azure OpenAI | Tokens per response | Cache frequent responses, use gpt-4o-mini |
| Graph API | API calls | Batch + cache = 70% reduction |
| Cosmos DB (state) | RU/s | Serverless for low volume |
Monthly cost estimate (1000 active users, 10 messages/user/day):
| Component | Cost |
|---|---|
| Bot Service (Free tier, up to 10K) | $0 |
| App Service (B1) | $55/mo |
| Azure OpenAI (gpt-4o-mini) | $15/mo |
| Cosmos DB (Serverless) | $5/mo |
| Total | ~$75/mo |
After tuning, compare:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.