microsoft-365-agents-toolkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited microsoft-365-agents-toolkit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build Microsoft 365 agents and Teams apps using the ATK CLI.
env/.env.local, .localConfigs, and atk auth list. Common pitfalls:aadApp/create missing generateServicePrincipal: true in YAML — add it and re-provision.localConfigs → SDK uses wrong token authority → 401 from Bot Connectoratk new, atk provision, atk deploy can take several minutesnpm run dev, npm start, python app.py, devtunnel host, etc. will hang — the process keeps running indefinitelyisBackground=true) — NEVER use isBackground=false for these commandsatk CLI commands, set the session environment variable so all CLI invocations are tagged as skill-initiated: export ATK_CLI_SKILL=trueRun this once at the start of the session. All subsequent atk commands in the same terminal will inherit it.
atk --version # Must be > 1.1.5-betaIf ATK is not found or version is too old:
npm i -g @microsoft/m365agentstoolkit-cli@beta| Option | Meaning | Recommendation |
|---|---|---|
-i | Interactive mode | Always use -i false in automation to avoid hanging |
-f | Project folder | Default to be current directory, used when specifying a custom folder. When scaffolding a new project, this is the parent folder where the project folder will be created under. |
-h | Command help | Use atk <command> -h for quick syntax checks |
| Sub-Skill | When to Use | Reference |
|---|---|---|
| create-project | Scaffold new project from template, choose template, atk new | create-project/create-project.md |
| test-playground | Test locally with Agents Playground, agentsplayground, quick testing | test-playground/test-playground.md |
| test-teams | Run on Teams, devtunnel, sideload, Teams testing, test in Copilot | test-teams/test-teams.md |
| provision-deploy | Provision Azure resources, deploy to cloud, atk provision, atk deploy | provision-deploy/provision-deploy.md |
| troubleshoot | Fix errors, 401, port conflicts, YAML errors, stale bots | troubleshoot/troubleshoot.md |
| slack-to-teams | Migrate Slack bot to Teams, cross-platform bridging, Block Kit to Adaptive Cards | slack-to-teams/SKILL.md |
MANDATORY: Before executing any workflow, read the corresponding sub-skill document.
Match user intent to the smallest valid workflow.
| User Intent | Workflow (read in order) |
|---|---|
| Build new app from scratch | create-project → test-playground |
| Test existing project locally | test-playground (recommended) or test-teams |
| Deploy to Azure | provision-deploy |
| Fix broken bot | troubleshoot → re-test |
| Migrate Slack bot to Teams | slack-to-teams |
MANDATORY: Before executing any slack-to-teams workflow, read slack-to-teams/SKILL.md first. The sub-skill contains a routed expert system with 100+ micro-expert files for cross-platform bot development.
Resolve config values only when missing. If a value is already known in the session, reuse it.
If m365agentstoolkit*.yml exists in the current folder, treat it as an ATK project and parse configuration.
Resolve variables referenced in m365agentstoolkit*.yml. Common variables: AZURE_OPENAI_API_KEY AZURE_OPENAI_ENDPOINT AZURE_OPENAI_DEPLOYMENT_NAME
If required values are missing, ask the user for only the missing ones.
Refer to manifest-and-yaml.md for full config-file details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.