COPILOT AUDITOR

Copilot Studio Agent Security Scanner · eusebio@it-sec

🤖

Drop Agent JSON here

or click to browse
Exported .json from Copilot Studio

— or paste JSON directly —

Agent Name (optional — overrides JSON)

Environment

Agent Type

//  Audit Rules

AuthenticationNo-auth topics, missing identity checks

PermissionsOverprivileged connections, broad scopes

Topic HygieneSensitive topics, fallback gaps, escalation

Data LeakagePII exposure, unfiltered output, logging

Prompt InjectionInput validation, jailbreak surface

ConnectionsRisky connectors, external APIs

Hardcoded SecretsKeys, tokens, passwords in config

DLP ComplianceCross-boundary connector mixing

//  Sensitivity

Report Threshold

//  How to Export an Agent

// Method 1 — Export from Copilot Studio Portal 1. Go to copilotstudio.microsoft.com
2. Open the agent you want to audit
3. Click Settings → Export → Export as solution (.zip)
4. Unzip → find the bot definition JSON inside the solution
5. Paste the contents here

// Method 2 — Power Platform CLI

            # Install CLI

            npm install -g @microsoft/powerplatform-cli

            # Export agent solution

            pac solution export --path agent.zip --name AgentName

            # Unzip and find bot JSON

            unzip agent.zip -d ./agent-export

// Method 3 — Load Sample Agent Click Load Sample Agent below to run a demo audit with a pre-built agent containing real security issues.

ⓘ NOTE: This tool runs entirely in your browser. No agent data is sent to any server.

AUDIT

eusebio@it-sec:~/tools/copilot-auditor$ awaiting input

Upload or paste a Copilot Studio agent JSON,
then click Audit Agent

or click "Load Sample Agent" for a demo audit