Audit candidate: microsoft/skills

[github-actions]

Repo

https://github.com/microsoft/skills

Field	Value
Stars	2861
NL Artifacts	226

Next Steps

1. Review the repo — check CONTRIBUTING.md, recent activity, PR history
2. If worthy: add label audit-ready to trigger the audit workflow
3. If not: close this issue

Checklist

• Accepts contributions
• Updated in last 60 days
• Not a fork or mirror
• Has meaningful NL artifacts

[github-actions]

Security Gate: BLOCKED

Critical security patterns detected in 1 file(s).
High-risk patterns in 0 file(s).

This repo will be audited for NL quality but will NOT receive automated PRs.
Manual security review required before any contributions.

[github-actions]

Audit Complete: microsoft/skills

NL Score: 94/100 | Security: BLOCKED | Artifacts: 226 | Strategy: progressive

NLPM Audit: microsoft/skills

Date: 2026-04-06 | Artifacts: 226 | Strategy: progressive
NL Score: 94/100
Security: BLOCKED
Bugs: 3 | Quality Issues: 100 | Security Findings: 5

NL Score Summary

File	Type	Score	Top Issue
.github/agents/presenter.agent.md	agent	64	Zero <example> blocks; 'execute'/'search' tools unused; no output-format spec
.github/agents/frontend.agent.md	agent	67	Zero <example> blocks; model tier not declared; no output-format spec
.github/agents/backend.agent.md	agent	67	Zero <example> blocks; model tier not declared; no output-format spec
.github/agents/infrastructure.agent.md	agent	67	Zero <example> blocks; model tier not declared; no output-format spec
.github/skills/skill-creator/SKILL.md	skill	70	Body is 1310 lines (>2.5x the skill's own 500-line rule) + heavy vague-quantifier usage
.github/agents/planner.agent.md	agent	73	Zero <example> blocks; declared 'web' tool never used
.github/plugins/deep-wiki/agents/wiki-writer.md	agent	74	Zero <example> blocks; heaviest vague-quantifier usage
.github/agents/scaffolder.agent.md	agent	77	Zero <example> blocks; model tier not declared
.github/plugins/deep-wiki/agents/wiki-researcher.md	agent	78	Zero <example> blocks; no tools declared
.github/plugins/deep-wiki/agents/wiki-architect.md	agent	80	Zero <example> blocks; no tools declared
.github/plugins/deep-wiki/commands/ask.md	command	81	No empty-input handling; no argument-hint
.github/plugins/azure-sdk-java/skills/azure-communication-callingserver-java/SKILL.md	skill	85	Thin/generic frontmatter description
.github/skills/mcp-builder/SKILL.md	skill	85	No inline code examples in Implementation phase; 5 vague quantifiers
.github/plugins/azure-sdk-python/skills/azure-cosmos-py/SKILL.md	skill	87	Broken reference: scripts/setup_cosmos_container.py does not exist
.github/plugins/azure-sdk-python/skills/azure-ai-projects-py/SKILL.md	skill	88	Broken cross-reference to nonexistent azure-ai-agents-python skill
.github/skills/copilot-sdk/SKILL.md	skill	88	Body is 901 lines, far over the 500-line guidance
.github/plugins/azure-sdk-java/skills/azure-monitor-query-java/SKILL.md	skill	89	Body 422 lines (400-500 band) + 3 vague quantifiers
.github/plugins/deep-wiki/commands/changelog.md	command	90	No argument-hint; no empty-git-history handling
.github/plugins/deep-wiki/commands/build.md	command	90	No argument-hint; missing-wiki precondition not actually checked
.github/plugins/azure-sdk-python/skills/azure-identity-py/SKILL.md	skill	90	Body exceeds 500 lines (533)
.github/plugins/azure-sdk-python/skills/azure-search-documents-py/SKILL.md	skill	90	Body exceeds 500 lines (543), duplicated section
.github/plugins/azure-sdk-java/skills/azure-monitor-ingestion-java/SKILL.md	skill	90	Broken cross-reference (wrong relative path to query skill)
.github/skills/applicationinsights-web-ts/SKILL.md	skill	90	Description + body both in penalized length bands
.github/skills/kql/SKILL.md	skill	90	Description + body both in penalized length bands
.github/skills/cloud-solution-architect/SKILL.md	skill	93	44 design patterns/complex concepts with no code examples
.github/skills/frontend-design-review/SKILL.md	skill	93	Description 500-800 chars + vague quantifier
.github/plugins/deep-wiki/commands/generate.md	command	95	No argument-hint despite consuming $ARGUMENTS
.github/plugins/deep-wiki/commands/agents.md	command	95	No argument-hint despite consuming $ARGUMENTS
.github/plugins/deep-wiki/commands/deploy.md	command	95	No argument-hint despite consuming $ARGUMENTS
.github/plugins/azure-sdk-python/skills/azure-ai-voicelive-py/SKILL.md	skill	95	Description 500-800 chars
.github/plugins/azure-sdk-java/skills/azure-appconfiguration-java/SKILL.md	skill	95	Body 476 lines (400-500 band)
.github/skills/debugview/SKILL.md	skill	95	Description 500-800 chars
.github/skills/entra-agent-id/SKILL.md	skill	95	Description 500-800 chars
.github/plugins/azure-sdk-python/skills/azure-mgmt-fabric-py/SKILL.md	skill	96	2 vague quantifiers
.github/skills/github-issue-creator/SKILL.md	skill	96	2 vague quantifiers
.github/plugins/azure-sdk-python/skills/azure-cosmos-db-py/SKILL.md	skill	97	No scope note distinguishing from sibling azure-cosmos-py
.github/plugins/azure-sdk-java/skills/azure-security-keyvault-secrets-java/SKILL.md	skill	97	No cross-reference to sibling Key Vault Keys skill
.github/plugins/azure-sdk-java/skills/azure-communication-callautomation-java/SKILL.md	skill	97	No cross-reference to azure-communication-common-java
.github/plugins/azure-sdk-java/skills/azure-communication-chat-java/SKILL.md	skill	97	No cross-reference to azure-communication-common-java
.github/plugins/azure-sdk-java/skills/azure-security-keyvault-keys-java/SKILL.md	skill	97	No cross-reference to sibling Key Vault Secrets skill
.github/plugins/azure-sdk-dotnet/skills/azure-mgmt-arizeaiobservabilityeval-dotnet/SKILL.md	skill	98	Vague quantifier ("properly")

---

Full report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/microsoft-skills.md

SECURITY BLOCKED: Critical/High security issues found. Do NOT submit automated PRs. Manual security review required.

[github-actions]

Security disclosure auto-filing failed (default GITHUB_TOKEN cannot create issues on third-party repos). Body queued at auditor/disclosures-pending/microsoft-skills.md for manual filing.