Security review sheet: Procurement evaluation summary (corp-procurement-eval, v1.0.0)
This sheet supports your organisation's review. It is not a certification, and it does not state that anything meets a law, regulation or standard.

1. Purpose: Writes up what the panel decided against the approved plan, checks the arithmetic, and will not move a score.
2. Skill owner role: [FILL IN]
3. Files: see the zip. SKILL.md, references/worked-example.md, declarativeAgent.json, manifest.json, instruction.txt, color.png, outline.png, NOTICE.txt.
4. Scripts: none. Open each file in Notepad to confirm.
5. Web addresses: none in SKILL.md or instruction.txt. manifest.json has three placeholders (fill-in.invalid) because Microsoft's format requires them. Replace them with your own internal pages.
6. Actions, plugins and tools declared: none.
7. Web search: not declared. Other capabilities: not declared. The agent reads only what the user supplies.
8. Knowledge sources: none by default. To add SharePoint, list each item. Leaving the list out lets the agent search all the SharePoint and OneDrive the user can reach.
9. Data it may see and highest classification: [FILL IN]. Tender content is commercial-in-confidence, and evaluation material is restricted to the panel and delegate until the award. Check that everyone with access to this Copilot workspace is allowed to see it.
10. Where processing happens: the Copilot service under your existing agreement, for you to confirm. The skill adds no new outbound path, and it does not change how the service handles data.
11. What a text skill cannot enforce: it cannot block tools or web access Copilot already has. For GitHub Copilot, use admin settings (for example agent mode off, network limits, no standalone customisations). For Microsoft 365 Copilot, admins control web search and agent access.
12. Human sign-off chain: [FILL IN]
13. What it refuses: see "Stop or refuse when" in SKILL.md.
14. Testing: your own trial on invented material: [FILL IN]. The publisher has not run this in real GitHub Copilot or Microsoft 365 Copilot.
15. Re-test when the model changes: [FILL IN]
16. How changes are approved and recorded: see "Change log" in SKILL.md. [FILL IN: process]
17. How to withdraw it: delete the folder, or an admin blocks or removes the agent in the Microsoft 365 admin center.
18. Risks to weigh (names from the FINOS AI Governance Framework, CC BY 4.0): information leaked to hosted model; prompt injection; hallucination and inaccurate outputs; model overreach; foundation model versioning; skill and plugin supply chain compromise; regulatory compliance and oversight. Your assessment: [FILL IN]
19. Open questions: [FILL IN]
20. Decision: approved / approved with conditions / not approved. IT or risk: ____ Name: ____ Date: ____
