Python: Add security information to harness features inline docs

[westey (westey-m)]

Motivation & Context

• Help developers understand the risks that they need to mitigate for when integrating with external services and components.

Description & Review Guide

• Add security information to harness features inline docs

Related Issue

Fixes #

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 59% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by westey-m's agents

[Copilot]

Pull request overview

Adds inline security guidance across the Python harness feature docs and key samples to help developers reason about trust boundaries when integrating external components (secondary LLMs, remote skill sources, telemetry backends, etc.).

Changes:

• Added “Security Considerations” sections to multiple Python samples (harness, middleware/judge loop, compaction, MCP skills, observability).
• Added security-focused docstrings to core harness-related APIs (skills sources/provider, background agents, judge middleware, summarization, observability settings).
• Normalized a few Microsoft Learn links in the observability sample README (removed /en-us locale prefix).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/samples/02-agents/skills/mcp_based_skill/README.md	Adds MCP skill discovery trust-boundary guidance for external MCP servers.
python/samples/02-agents/observability/README.md	Updates docs links and adds telemetry/sensitive-data security guidance.
python/samples/02-agents/middleware/README.md	Documents security implications of using a judge client in the loop.
python/samples/02-agents/harness/README.md	Summarizes security considerations for multiple opt-in harness capabilities.
python/samples/02-agents/compaction/README.md	Highlights summarization as a persistent prompt-injection vector vs other strategies.
python/packages/core/agent_framework/observability.py	Adds security considerations to ObservabilitySettings docstring.
python/packages/core/agent_framework/_skills.py	Adds security considerations for SkillsProvider, SkillsSource, and MCPSkillsSource.
python/packages/core/agent_framework/_harness/_loop.py	Adds security considerations to AgentLoopMiddleware.with_judge docs.
python/packages/core/agent_framework/_harness/_background_agents.py	Documents security implications of delegating to background agents.
python/packages/core/agent_framework/_harness/_agent.py	Adds security notes for skills_provider and background_agents arguments.
python/packages/core/agent_framework/_compaction.py	Adds security notes to SummarizationStrategy docs and constructor args.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/core/agent_framework
_compaction.py	676	51	92%	108–109, 117, 184–185, 203–204, 221, 255, 269, 276, 291–292, 346, 353, 369, 419, 443, 474, 521, 527, 529, 548, 592–597, 609, 681, 683, 698, 742, 804, 926, 1001, 1003, 1019, 1026, 1031, 1046, 1054, 1148, 1151, 1169, 1185, 1281, 1308, 1313, 1392
_skills.py	1055	39	96%	314, 587, 1107, 1122, 1124–1125, 1492–1493, 1737, 1766, 2213, 2394, 2871–2872, 2969, 2977, 2982, 2985, 2990, 3010, 3022, 3027, 3122, 3130, 3135, 3138, 3143, 3163, 3172, 3177, 3443–3444, 3854, 4094–4095, 4122–4123, 4130–4131
observability.py	1011	87	91%	408, 410–411, 414, 417, 420–421, 426–427, 433–434, 440–441, 448, 450–452, 455–457, 462–463, 469–470, 476–477, 484, 661–662, 872, 876–878, 880, 884–885, 889, 927, 929, 940–942, 944–946, 950, 958, 1082–1083, 1318, 1593–1594, 1705, 1852, 1891–1892, 2074, 2357–2360, 2366, 2392–2393, 2421–2432, 2551, 2554, 2566, 2583, 2587–2588, 2591, 2597, 2706, 2923, 2925
packages/core/agent_framework/_harness
_agent.py	113	4	96%	184, 544–545, 547
_background_agents.py	258	20	92%	169, 194–195, 220–222, 225–226, 229–230, 383, 428, 431, 456, 465, 469, 528–531
_loop.py	279	7	97%	496, 504, 579, 653, 696, 771, 927
TOTAL	44003	5303	87%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8593	33 💤	0 ❌	0 🔥	2m 13s ⏱️