Build Teams.ai Apps with Anthropic Claude

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for adding Anthropic Claude and optional You.com search to a Teams.ai app, with expected notes around external packages, API keys, and MCP data flow.

This appears safe to use as a development guide if you are comfortable installing the named packages and sending app messages to Anthropic and, if enabled, You.com. Pin dependencies, keep API keys out of source control, and review external provider data handling before using it with sensitive Teams content.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing unpinned packages can pull in newer package or dependency versions later, which may change behavior in a Teams app.

Why it was flagged

The skill asks the user to install external npm packages as the core setup mechanism. This is purpose-aligned, but the versions are not pinned in the shown instructions.

Skill content

npm install @youdotcom-oss/teams-anthropic @anthropic-ai/sdk @microsoft/teams.ai

Recommendation

Verify the npm package source, pin dependency versions, commit a lockfile, and review package updates before deploying.

Low

#ASI03: Identity and Privilege Abuse

What this means

If these keys are exposed, someone else could use the user’s Anthropic or You.com account quota or access.

Why it was flagged

The skill instructs users to configure Anthropic and You.com API keys. These credentials are expected for the stated services, but they grant access to paid/provider accounts.

Skill content

ANTHROPIC_API_KEY=your-anthropic-api-key
YDC_API_KEY=your-you-com-api-key

Recommendation

Store keys securely, avoid committing .env files, rotate keys if exposed, and use the least-privileged keys available.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Teams messages or search queries may be sent to external AI/search services when the app uses Claude and You.com MCP.

Why it was flagged

The optional path connects the Teams.ai app to an MCP-based external search/content extraction service. This is disclosed and purpose-aligned, but it creates an external tool/data boundary.

Skill content

Optionally integrate You.com MCP server for web search and content extraction.

Recommendation

Review provider data policies, avoid sending sensitive Teams content unless appropriate, and document when external tools are used.