M365 Declarative Agent Developer
Create, edit, localize, and deploy declarative agents for Microsoft 365 Copilot and Teams.
The document requires least-privilege scoping, secret protection, environment-based credentials, OAuth handling, and confirmation for create, update, and delete actions. However, user-authorization boundaries, data-flow disclosure, rollback procedures, and permission isolation for deployment and external API/MCP calls are underspecified; the rule requiring deployment after every edit can also create external effects without sufficient confirmation, so points are deducted.
Workspace gates, ordered error handling, schema-version checks, and CLI prerequisites are reasonably explicit. Reliability is reduced by dependence on npx/ATK, external services, and several referenced files not included in the evidence, plus tension between not installing the CLI and using npx -y, while network failures, abnormal inputs, and deployment failures lack fully diagnostic handling. Static calibration limits the score.
Audience, scenarios, trigger phrases, and major workflows are fairly clear, covering scaffolding, editing, plugins, OAuth, deployment, and localization. Boundaries for non-fit cases, precise semantic triggering, Chinese-language examples, and mainland-China network reachability are not sufficiently documented; mandatory deployment may also be unsuitable for advisory-only or restricted environments.
The material is layered across workspace gates, routing, authentication, plugins, conversation design, and deployment, with examples, limits, naming guidance, and security practices. Versioning, changelog ownership, explicit maintenance responsibility, and update paths are incomplete; several referenced materials are absent from the supplied evidence, and repetitive mandatory rules reduce maintainability. The supplied MIT license and verified Microsoft provenance support governance evidence only, not functional quality.
The skill offers directly actionable workflows for common M365 declarative-agent creation, editing, plugin integration, localization, and deployment tasks, with a clear value proposition. Static evidence does not establish successful execution of key paths, several steps depend on unavailable references or external state, and mandatory deployment after each edit adds cost and workflow friction, so the score remains moderate.
Commands, configuration snippets, decision tables, architecture examples, and reference titles provide some auditability. There are no execution records, real CI workflows, committed test suites, or independent reproduction evidence in the supplied files, and several key references are incomplete or unavailable; therefore the static ceiling applies.
- This is a static source review only; ATK, npx, OAuth, MCP handshakes, and deployment were not executed, so examples should not be treated as verified.
- The mandatory deploy-after-every-edit rule may create external state changes; actual use should add explicit user confirmation, scoped permissions, and a rollback plan.
- Core workflows depend on Microsoft 365, the ATK CLI, npx, and external services; reachability and stability from mainland-China networks are not established by the supplied evidence.
- Several referenced workflow, schema, and localization files were not supplied, so completeness and version consistency require manual verification.
What does this skill do, and when should you use it?
This skill is a focused developer workflow for declarative agents targeting Microsoft 365 Copilot and Teams. It covers workspace fingerprinting, manifest editing, capabilities and plugins, OAuth, MCP integration, instruction review, localization, and deployment. Before acting on an existing project, it checks the ATK CLI, project files, and declarativeAgent.json, then routes the task through reject, fix, review, or edit gates. The repository is MIT-licensed, while this skill depends on the Microsoft 365 Agent Toolkit CLI workflow.
It requires running npx -y --package @microsoft/m365agentstoolkit-cli atk --version and checking for m365agents.yml, teamsApp.yml, appPackage/declarativeAgent.json, and non-agent project indicators. It guides agents through reading and editing declarative-agent JSON manifests, adding API plugins, MCP servers, and OAuth, updating instructions and conversation starters, creating tokenized manifests and language files, and deploying changes with atk provision --env local --interactive false. For missing files, malformed JSON, validation errors, or incompatible features, it requires detection, user notification, and confirmation before changes.
- A developer starting a new Microsoft 365 Copilot or Teams declarative agent can follow the scaffolding workflow.
- A team with an existing declarativeAgent.json can use the editing and ATK CLI workflows to add capabilities or API plugins.
- A developer integrating a remote MCP server or OAuth-enabled plugin can follow the MCP and authentication workflows.
- A team adding multiple languages to an agent can use the tokenized-manifest and language-file localization workflow.
- A developer whose agent gives generic or incorrect answers can use the instruction-review workflow to improve its instructions.
What are this skill's strengths and limitations?
- Covers the full declarative-agent lifecycle from creation and editing through deployment.
- Defines explicit workspace checks, error handling, schema-version gates, and deployment safeguards.
- Addresses API plugins, MCP, OAuth, instruction review, and localization.
- Uses the open Agent Skills convention with name and description YAML frontmatter.
- Requires npx, the @microsoft/m365agentstoolkit-cli package, network access, and local filesystem access.
- The deploy-after-edit rule may not suit workflows limited to offline manifest changes.
- The source provides no independent test coverage or platform compatibility matrix for this specific skill.
- MCP integration requires protocol-handshake tool discovery rather than inferring tools from a URL.
How do you install this skill?
To install the collection, run npx skills add microsoft/skills and select the required skill in the wizard. Skills are installed in the selected agent's directory, such as .github/skills/ for GitHub Copilot. The collection can also be cloned from https://github.com/microsoft/skills and the relevant skill directory copied. The source does not document a separate installation command for .github/plugins/microsoft-365-agents-toolkit/skills/declarative-agent-developer/.
How do you use this skill?
Place the skill in a compatible Agent Skills directory and use a matching request such as “create a declarative agent,” “add an API plugin,” “add an MCP plugin,” “localize my agent,” or “fix my agent manifest.” The workflow first runs npx -y --package @microsoft/m365agentstoolkit-cli atk --version and checks the workspace. After editing appPackage/, it normally runs npx -y --package @microsoft/m365agentstoolkit-cli atk provision --env local --interactive false; deployment is prohibited while manifest errors remain.