AI Agent Posture
SCStelz/security-investigator
Audit or report on AI agent security posture across Copilot Studio, Microsoft 365 Copilot, Microsoft Foundry, and third-party agents.
Microsoft 365 Agents SDK for TypeScript/Node.js. An agent skill from microsoft/skills.
$ npx skills add microsoft/skills --skill m365-agents-ts -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install microsoft/skills m365-agents-ts --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts .claude/skills/m365-agents-ts && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "m365-agents-ts" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts into .claude/skills/m365-agents-ts/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-ts", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-typescript/skills/m365-agents-tsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add microsoft/skills --skill m365-agents-ts -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install microsoft/skills m365-agents-ts --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts .agents/skills/m365-agents-ts && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "m365-agents-ts" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts into .agents/skills/m365-agents-ts/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-ts", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/skills --skill m365-agents-ts -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install microsoft/skills m365-agents-ts --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts .cursor/skills/m365-agents-ts && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "m365-agents-ts" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts into .cursor/skills/m365-agents-ts/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-ts", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/microsoft/skills.git --path .github/plugins/azure-sdk-typescript/skills/m365-agents-ts--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add microsoft/skills --skill m365-agents-ts -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install microsoft/skills m365-agents-ts --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts .gemini/skills/m365-agents-ts && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "m365-agents-ts" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts into .gemini/skills/m365-agents-ts/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-ts", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install microsoft/skills m365-agents-tsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add microsoft/skills --skill m365-agents-ts -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts .github/skills/m365-agents-ts && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "m365-agents-ts" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts into .github/skills/m365-agents-ts/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-ts", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/skills --skill m365-agents-ts -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install microsoft/skills m365-agents-ts --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts .opencode/skills/m365-agents-ts && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "m365-agents-ts" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-typescript/skills/m365-agents-ts into .opencode/skills/m365-agents-ts/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-ts", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
m365-agents-tsMicrosoft 365 Agents SDK for TypeScript/Node.js. An agent skill from microsoft/skills.
M365 Agents TS is an agent skill from microsoft/skills, published by the product's own GitHub organization. Microsoft 365 Agents SDK for TypeScript/Node.js. Build multichannel agents for Teams/M365/Copilot Studio with AgentApplication routing, Express hosting, streaming responses, and Copilot Studio client integration. Triggers: "Microsoft 365 Agents SDK", "@microsoft/agents-hosting", "AgentApplication", "startServer", "streamingResponse", "Copilot Studio client", "@microsoft/agents-copilotstudio-client".
Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Documents & Office, covering Cloud office suites and LLM API integration. It works with Microsoft 365, Microsoft Copilot Studio, TypeScript and Node.js. The repository describes itself as: Skills, MCP servers, Custom Agents, Agents.md for SDKs to ground Coding Agents. The licence is MIT.
5 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 354361d. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
npmFrom the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
schema.orgAlso links to:
learn.microsoft.comgithub.comFrom URLs in SKILL.md, links to its own repository left out.
Names these keys or tokens, usually read from environment variables:
COPILOT_BEARER_TOKENAZURE_API_KEYCLIENT_SECRETFrom names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
M365 Agents TS loads about 1.7k tokens when it runs. Until then it costs about 104 tokens; SKILL.md has 172 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from microsoft/skills at commit 354361d, republished under its MIT licence (© microsoft). 172 words, ~1,720 tokens.
.claude/skills/m365-agents-ts/SKILL.md (or your agent's skills folder).Build enterprise agents for Microsoft 365, Teams, and Copilot Studio using the Microsoft 365 Agents SDK with Express hosting, AgentApplication routing, streaming responses, and Copilot Studio client integrations.
npm install @microsoft/agents-hosting @microsoft/agents-hosting-express @microsoft/agents-activity
npm install @microsoft/agents-copilotstudio-clientPORT=3978
AZURE_RESOURCE_NAME=<azure-openai-resource>
AZURE_API_KEY=<azure-openai-key>
AZURE_OPENAI_DEPLOYMENT_NAME=gpt-4o-mini
TENANT_ID=<tenant-id>
CLIENT_ID=<client-id>
CLIENT_SECRET=<client-secret>
COPILOT_ENVIRONMENT_ID=<environment-id>
COPILOT_SCHEMA_NAME=<schema-name>
COPILOT_CLIENT_ID=<copilot-app-client-id>
COPILOT_BEARER_TOKEN=<copilot-jwt>import {
AgentApplication,
TurnContext,
TurnState,
} from "@microsoft/agents-hosting";
import { startServer } from "@microsoft/agents-hosting-express";
const agent = new AgentApplication<TurnState>();
agent.onConversationUpdate("membersAdded", async (context: TurnContext) => {
await context.sendActivity("Welcome to the agent.");
});
agent.onMessage("hello", async (context: TurnContext) => {
await context.sendActivity(`Echo: ${context.activity.text}`);
});
startServer(agent);import { azure } from "@ai-sdk/azure";
import {
AgentApplication,
TurnContext,
TurnState,
} from "@microsoft/agents-hosting";
import { startServer } from "@microsoft/agents-hosting-express";
import { streamText } from "ai";
const agent = new AgentApplication<TurnState>();
agent.onMessage("poem", async (context: TurnContext) => {
context.streamingResponse.setFeedbackLoop(true);
context.streamingResponse.setGeneratedByAILabel(true);
context.streamingResponse.setSensitivityLabel({
type: "https://schema.org/Message",
"@type": "CreativeWork",
name: "Internal",
});
await context.streamingResponse.queueInformativeUpdate("starting a poem...");
const { fullStream } = streamText({
model: azure(process.env.AZURE_OPENAI_DEPLOYMENT_NAME || "gpt-4o-mini"),
system: "You are a creative assistant.",
prompt: "Write a poem about Apollo.",
});
try {
for await (const part of fullStream) {
if (part.type === "text-delta" && part.text.length > 0) {
await context.streamingResponse.queueTextChunk(part.text);
}
if (part.type === "error") {
throw new Error(`Streaming error: ${part.error}`);
}
}
} finally {
await context.streamingResponse.endStream();
}
});
startServer(agent);import { Activity, ActivityTypes } from "@microsoft/agents-activity";
import {
AgentApplication,
TurnContext,
TurnState,
} from "@microsoft/agents-hosting";
const agent = new AgentApplication<TurnState>();
agent.onActivity("invoke", async (context: TurnContext) => {
const invokeResponse = Activity.fromObject({
type: ActivityTypes.InvokeResponse,
value: { status: 200 },
});
await context.sendActivity(invokeResponse);
await context.sendActivity("Thanks for submitting your feedback.");
});import { CopilotStudioClient } from "@microsoft/agents-copilotstudio-client";
const settings = {
environmentId: process.env.COPILOT_ENVIRONMENT_ID!,
schemaName: process.env.COPILOT_SCHEMA_NAME!,
clientId: process.env.COPILOT_CLIENT_ID!,
};
const tokenProvider = async (): Promise<string> => {
return process.env.COPILOT_BEARER_TOKEN!;
};
const client = new CopilotStudioClient(settings, tokenProvider);
const conversation = await client.startConversationAsync();
const reply = await client.askQuestionAsync("Hello!", conversation.id);
console.log(reply);import { CopilotStudioWebChat } from "@microsoft/agents-copilotstudio-client";
const directLine = CopilotStudioWebChat.createConnection(client, {
showTyping: true,
});
window.WebChat.renderWebChat(
{
directLine,
},
document.getElementById("webchat")!,
);| Resource | URL |
|---|---|
| Microsoft 365 Agents SDK | https://learn.microsoft.com/en-us/microsoft-365/agents-sdk/ |
| JavaScript SDK overview | https://learn.microsoft.com/en-us/javascript/api/overview/agents-overview?view=agents-sdk-js-latest |
| @microsoft/agents-hosting-express | https://learn.microsoft.com/en-us/javascript/api/%40microsoft/agents-hosting-express?view=agents-sdk-js-latest |
| @microsoft/agents-copilotstudio-client | https://learn.microsoft.com/en-us/javascript/api/%40microsoft/agents-copilotstudio-client?view=agents-sdk-js-latest |
| Integrate with Copilot Studio | https://learn.microsoft.com/en-us/microsoft-365/agents-sdk/integrate-with-mcs |
| GitHub samples | https://github.com/microsoft/Agents/tree/main/samples/nodejs |
© microsoft, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in .github/plugins/azure-sdk-typescript/skills/m365-agents-ts of microsoft/skills.
Open the folder on GitHubat commit 354361d
We found 16 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 6 other GitHub owners. This page covers the copy in microsoft/skills, which our catalogue first saw on October 7, 2026.
M365 Agents TS next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| M365 Agents TS this skillmicrosoft/skills | 3.1k | 6 repos | ~1.7k | Automated safety check: Pass | MIT | |
| AI Agent PostureSCStelz/security-investigator | 249 | — | ~21k | Automated safety check: Pass | MIT | |
| Msgraph SDKgithub/awesome-copilot | 40k | — | ~2.1k | Automated safety check: Pass | MIT | |
| Purview Dspm AIvinayaklatthe/microsoft-security-skills | 175 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Msgraphcodemie-ai/codemie-code | 294 | — | ~4.1k | Automated safety check: Pass | Apache-2.0 | |
| Openai APImajiayu000/claude-skill-registry | 666 | 1 repos | ~7.6k | Automated safety check: Notes | MIT |
SCStelz/security-investigator
Audit or report on AI agent security posture across Copilot Studio, Microsoft 365 Copilot, Microsoft Foundry, and third-party agents.
github/awesome-copilot
Integrate Microsoft Graph SDK into any project — .NET, TypeScript/JavaScript, or Python.
vinayaklatthe/microsoft-security-skills
Guidance for Microsoft Purview Data Security Posture Management for AI (DSPM for AI) - discovering, monitoring, and protecting sensitive data interactions with generative AI apps like Microsoft 365…
codemie-ai/codemie-code
Work with Microsoft 365 services via the Graph API — emails, calendar events, SharePoint sites (read and write), Teams chats and channel messages, OneDrive files, OneNote notebooks, Planner task…
majiayu000/claude-skill-registry
A skill your agent uses when implementing GPT chat, streaming, function calling, embeddings for RAG, images, audio or batch jobs, or troubleshooting 429 rate limits and API or TypeScript errors.
arcships/light-ocr
Extract text from local images (PNG, JPEG) with precise coordinates, confidence scores, and stable error handling using the light-ocr CLI.
microsoft/skills
Reference for building on Microsoft Foundry with the azure-ai-projects Python SDK: project clients, versioned agents, evaluations, connections, datasets and indexes.
microsoft/skills
Python guidance for the Azure AI Search SDK covering vector, hybrid and semantic search, index management and indexers, with Entra ID authentication preferred over keys.
microsoft/skills
Covers producer, consumer, and checkpoint-store setup for Azure Event Hubs streaming in Python, with Entra ID auth and partition targeting.
microsoft/skills
Create Pydantic models following the multi-model pattern with Base, Create, Update, Response, and InDB variants.
microsoft/skills
Captures and filters Windows user-mode and kernel debug output from the command line with the Sysinternals DebugView CLI, including bounded runs suited to agents.
microsoft/skills
Build dark-themed React applications using Tailwind CSS with custom theming, glassmorphism effects, and Framer Motion animations.
Categories
Microsoft 365 Agents SDK for TypeScript/Node.js. An agent skill from microsoft/skills. M365 Agents TS is an agent skill from microsoft/skills, published by the product's own GitHub organization.js.
M365 Agents TS fits situations like: tasks that involve Cloud office suites; tasks that involve LLM API integration.
Run `npx skills add microsoft/skills --skill m365-agents-ts -a claude-code`. Or copy the skill folder (.github/plugins/azure-sdk-typescript/skills/m365-agents-ts in microsoft/skills) into .claude/skills/m365-agents-ts in your project. Claude Code loads it when a task matches its description.
Run `npx skills add microsoft/skills --skill m365-agents-ts -a codex`. Or copy the skill folder (.github/plugins/azure-sdk-typescript/skills/m365-agents-ts in microsoft/skills) into .agents/skills/m365-agents-ts in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add microsoft/skills --skill m365-agents-ts -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/m365-agents-ts, .gemini/skills/m365-agents-ts, .github/skills/m365-agents-ts and .opencode/skills/m365-agents-ts in your project.
Going by SKILL.md and its folder, M365 Agents TS needs the command-line tools its instructions call (npm) and credentials named COPILOT_BEARER_TOKEN, AZURE_API_KEY and CLIENT_SECRET. Our summary lists: Node.js; A credential in AZURE_API_KEY; A credential in CLIENT_SECRET.
SKILL.md names 3 domains. In commands or code: schema.org; the agent is likely to contact it when it follows the instructions. As links in the text: learn.microsoft.com and github.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
M365 Agents TS is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 1.7k tokens (SKILL.md is roughly 6.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with M365 Agents TS: AI Agent Posture (SCStelz/security-investigator, 249 stars), Msgraph SDK (github/awesome-copilot, 40k stars), Purview Dspm AI (vinayaklatthe/microsoft-security-skills, 175 stars) and Msgraph (codemie-ai/codemie-code, 294 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
microsoft (a GitHub organization, an official publisher) maintains it in microsoft/skills, which has 3,091 GitHub stars. The repository holds 150 skills in this directory. The repository was last updated on October 6, 2026.
Source: microsoft/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.