Microsoft Code Reference

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Microsoft documentation lookup helper; the notable points are that it may send search queries to Microsoft Learn tools and offers an optional unpinned npm CLI fallback.

This skill appears safe and narrowly focused for Microsoft SDK documentation work. Before installing, be comfortable with sending documentation search terms to Microsoft Learn tools, and only use the npm CLI fallback if you trust the package source and do not mind a local/global CLI install.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the CLI fallback is used, the user's environment may run code from npm and a global install may change the local toolchain.

Why it was flagged

The optional fallback can download/run an npm package directly or install it globally, and the command does not pin a package version.

Skill content

npx @microsoft/learn-cli search "BlobClient UploadAsync Azure.Storage.Blobs" ... npm install -g @microsoft/learn-cli

Recommendation

Prefer the Microsoft Learn MCP server when available, or verify the @microsoft/learn-cli package source and consider pinning a trusted version before using the npm commands.

Info

#ASI07: Insecure Inter-Agent Communication

What this means

Search terms, error messages, or code identifiers included in lookups could be shared with the external documentation service.

Why it was flagged

The skill is designed to use an external MCP documentation service, so query text may be sent outside the local agent session.

Skill content

Works best with Microsoft Learn MCP Server (https://learn.microsoft.com/api/mcp).

Recommendation

Use normal caution with external searches: do not include secrets, credentials, private keys, or confidential source code in documentation queries.