Two hardening notes from a blind pre-registered read at ea1579f: AgenticUserId skips ValidateGuid before an az shell-out; config secret has no file-mode hardening on macOS/Linux

I run independent, pre-registered verification of AI-built systems (Trenyx; the published engagements are at https://trenyx.io/audits.html). I did a static-only read of microsoft/Agent365-devTools at commit ea1579f3 with the attack plan hashed and anchored before I opened a line of source. Nothing here crosses a security boundary (both items need write access to the user's own files), so this is a hardening note, not a vulnerability report. The MSAL-delegated auth, delegated-only flows, setup privilege scope, manifest handling and query-entra paths all held as documented, and the suite is real (about 1,700 Fact/Theory cases across 132 files).

1. AgenticUserId is the one identifier on Agent365Config that ConfigService never runs through ValidateGuid. Its siblings all are: TenantId (ConfigService.cs:391), ManagedIdentityPrincipalId (:399), AgenticAppId (:406), BotId (:412), BotMsaAppId (:416). The unvalidated value is then interpolated into az ad user delete --id {config.AgenticUserId} at CleanupCommand.cs:811 and :1113, and CommandExecutor.cs:37-41 wraps az in cmd.exe /c on Windows. The value comes from a365.generated.config.json, which your docs describe as CLI-managed and gitignored (docs/design.md:134), so only someone who can already write the user's state file can plant it. A one-line ValidateGuid on AgenticUserId gives the family parity and closes the gap on principle.

2. On macOS and Linux the client secret is stored in plaintext (SecretProtectionHelper.cs:44-48 warns at write time), and no file-mode hardening is applied to the config files that hold it; the CLI's own MSAL cache documents 0600 on Linux. Writing the config files with UnixFileMode 0600 (or chmod after write) would match that precedent.

Happy to re-check either change. The pre-registration hash and the full record publish on the audits page with the read.

SK
Trenyx