Security review sheet: Meeting minutes and action log (corp-minutes, v1.0.0)
This sheet supports your organisation's review. It is not a certification, and it does not state that anything meets a law, regulation or standard.

1. Purpose: Records what was decided, not who said what. Nothing counts as decided unless the notes say so.
2. Skill owner role: [FILL IN]
3. Files: see the zip. SKILL.md, references/worked-example.md, declarativeAgent.json, manifest.json, instruction.txt, color.png, outline.png, NOTICE.txt.
4. Scripts: none. Open each file in Notepad to confirm.
5. Web addresses: none in SKILL.md or instruction.txt. manifest.json has three placeholders (fill-in.invalid) because Microsoft's format requires them. Replace them with your own internal pages.
6. Actions, plugins and tools declared: none.
7. Web search: not declared. Other capabilities: not declared. The agent reads only what the user supplies.
8. Knowledge sources: none by default. To add SharePoint, list each item. Leaving the list out lets the agent search all the SharePoint and OneDrive the user can reach.
9. Data it may see and highest classification: [FILL IN]. Minutes carry the classification of the meeting. Items held in confidence stay in a separate record. Follow your records rules for keeping or deleting transcripts and recordings.
10. Where processing happens: the Copilot service under your existing agreement, for you to confirm. The skill adds no new outbound path, and it does not change how the service handles data.
11. What a text skill cannot enforce: it cannot block tools or web access Copilot already has. For GitHub Copilot, use admin settings (for example agent mode off, network limits, no standalone customisations). For Microsoft 365 Copilot, admins control web search and agent access.
12. Human sign-off chain: [FILL IN]
13. What it refuses: see "Stop or refuse when" in SKILL.md.
14. Testing: your own trial on invented material: [FILL IN]. The publisher has not run this in real GitHub Copilot or Microsoft 365 Copilot.
15. Re-test when the model changes: [FILL IN]
16. How changes are approved and recorded: see "Change log" in SKILL.md. [FILL IN: process]
17. How to withdraw it: delete the folder, or an admin blocks or removes the agent in the Microsoft 365 admin center.
18. Risks to weigh (names from the FINOS AI Governance Framework, CC BY 4.0): information leaked to hosted model; prompt injection; hallucination and inaccurate outputs; model overreach; foundation model versioning; skill and plugin supply chain compromise; regulatory compliance and oversight. Your assessment: [FILL IN]
19. Open questions: [FILL IN]
20. Decision: approved / approved with conditions / not approved. IT or risk: ____ Name: ____ Date: ____
