CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

m365-agents-py

Microsoft 365 Agents SDK for Python. Build multichannel agents for Teams/M365/Copilot Studio with aiohttp hosting, AgentApplication routing, streaming responses, and MSAL-based auth.

Quality

65%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./plugins/AI-Agents-Safe-Coding-Skills/skills/m365-agents-py/SKILL.md

The canonical home for this skill is m365-agents-py in administrakt0r/AI-Agents-Safe-Coding-Skills

SKILL.md
Quality
Evals
Security

Quality

Content

50%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-organized, code-heavy reference with strong concrete examples for every major SDK feature, but it reads as a monolith with real execution gaps. The duplicated `AgentApplicationTurnState` construction line, placeholder token cache, missing local-validation steps, and a Reference Files entry pointing to a nonexistent file keep it at mid-scale across all four dimensions.

Suggestions

Fix `AGENT_APP = AgentApplicationTurnState` to an actual AgentApplication construction (e.g., `AgentApplication(...)` with the appropriate state class) — it appears in both the Core Workflow and Routing sections and breaks both examples as written.

Remove the duplicated welcome/error and '/me' handlers and the vacuous 'When to Use' sentence; deduplicate to one canonical handler set to tighten token efficiency.

Either create `references/acceptance-criteria.md` or drop its row from the Reference Files table, and move detailed content (streaming, Copilot Studio client) into reference files per progressive-disclosure structure.

Add an explicit validation step (e.g., test the agent locally with the Bot Framework Emulator or curl the /api/messages endpoint) after the server setup to give the workflow a checkpoint.

DimensionReasoningScore

Conciseness

Most of the body is lean, high-signal code with minimal prose, but there is avoidable padding: the welcome and error handlers and the '/me' auth handler each appear twice across 'Core Workflow', 'AgentApplication Routing', and 'OAuth / Auto Sign-In' (~40 duplicated lines), and the closing 'When to Use' section ('This skill is applicable to execute the workflow or actions described in the overview') is pure filler. This fits 'mostly efficient but includes some unnecessary explanation or could be tightened' rather than anchor 4's only-minor trimming.

3 / 5

Actionability

The bulk is concrete, near-executable code (install commands, env vars, full aiohttp server setup), but key gaps block copy-paste use: `AGENT_APP = AgentApplicationTurnState` (in both major sections) assigns a class instead of constructing an AgentApplication and would fail as written, the routing snippet uses an undefined `Activity` symbol, and the Copilot Studio section ships a placeholder `class LocalTokenCache: pass`. This lands between anchor 4 (minor gaps) and anchor 2 (mostly hints); the broken core-object construction and pseudocode placeholders make it anchor 3.

3 / 5

Workflow Clarity

There is a usable implicit order — verify APIs via MCP, install, configure .env, build, route, stream, auth — and the destructive/batch cap does not apply. But there are no explicit validation checkpoints (e.g., run/test the agent locally, verify token acquisition, check streaming output) and no numbered sequence tying the sections together, matching anchor 3: 'sequence present but checkpoints missing or implicit'.

3 / 5

Progressive Disclosure

Section headers are clear and external links are organized in a table, but the entire detailed content (streaming, OAuth, Copilot Studio client) is inlined in one ~345-line file, and the 'Reference Files' table points to `references/acceptance-criteria.md` which does not exist in the bundle — a dangling, broken reference. This fits anchor 3 ('some structure, content that should be separate is inline, references not cleanly usable'), and it is not anchor 4 because the one listed reference is missing rather than merely imperfectly signaled.

3 / 5

Total

12

/

20

Passed

Description

66%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, third-person description that accurately enumerates the SDK's core capabilities with good natural keyword coverage. Its main weakness is the complete absence of a 'Use when...' trigger clause, which caps completeness and leaves its considerable capability list without explicit activation guidance.

Suggestions

Append an explicit trigger clause, e.g. 'Use when building Python bots/agents for Microsoft Teams, M365, or Copilot Studio with the Microsoft 365 Agents SDK.'

Add the natural synonym 'bot(s)' and 'Bot Framework' to bridge the common way users refer to Teams agents, improving trigger_term_quality toward 5.

Mention the OAuth user sign-in and Copilot Studio direct-to-engine client capabilities to close the minor specificity gaps.

DimensionReasoningScore

Specificity

The description lists several concrete capabilities — 'aiohttp hosting, AgentApplication routing, streaming responses, and MSAL-based auth' — naming the SDK's real features rather than generic language. It stops short of anchor 5 because coverage within the domain has minor gaps (e.g., user OAuth sign-in flows and the Copilot Studio direct-to-engine client are only implied by 'Copilot Studio').

4 / 5

Completeness

The 'what' is clearly and concretely answered (build multichannel agents for Teams/M365/Copilot Studio with hosting, routing, streaming, auth), but there is no 'Use when...' clause or equivalent trigger guidance anywhere in the description. Per the rubric guideline, a missing explicit trigger clause caps completeness at 3.

3 / 5

Trigger Term Quality

Natural terms a user would say are present: 'Microsoft 365', 'Teams', 'M365', 'Copilot Studio', 'Python', 'agents', 'streaming'. Missing a few common synonyms users say in this space — notably 'bot', 'Bot Framework', and '.py'/file-extension style triggers — so it fits 'good keyword coverage; a few natural terms missing' rather than comprehensive.

4 / 5

Distinctiveness Conflict Risk

Naming the specific product ('Microsoft 365 Agents SDK for Python') carves a clear niche, so it is well above anchor 3's generic overlap. It stays below anchor 5 because the broad terms 'Teams', 'M365', and 'Copilot Studio' create minor overlap risk with closely related skills (Bot Framework SDK, Teams tab development, Graph API work) given no 'when' scoping.

4 / 5

Total

15

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

14

/

16

Passed

Repository

administrakt0r/AI-Agents-Safe-Coding-Skills

Path

plugins/AI-Agents-Safe-Coding-Skills/skills/m365-agents-py/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.