Example C# task, the task.json is generated when run with --build argument. (Can be done as part of build step).

OauthBroker.ps

[CmdletBinding(DefaultParameterSetName = 'None')]
param
(
	[String] [Parameter(Mandatory = $true)]
	$ConnectedServiceName,
	[String] [Parameter(Mandatory = $false)]
	$KeyVaultName,
	[String] [Parameter(Mandatory = $false)]
	$SecretName,
	[String] [Parameter(Mandatory = $false)]
	$KeyVaultSecretTags,
	[String] [Parameter(Mandatory = $false)]
	$ThumbprintVariableName,
	[String] [Parameter(Mandatory = $false)]
	$SecretUriVariableName
)
$arg1 =  if ([String]::IsNullOrEmpty($KeyVaultName))				{ '' } else { @('--KeyVaultName',			('"'+$KeyVaultName+'"'))  }
$arg2 =  if ([String]::IsNullOrEmpty($SecretName))				{ '' } else { @('--SecretName',			('"'+$SecretName+'"'))  }
$arg3 =  if ([String]::IsNullOrEmpty($KeyVaultSecretTags))				{ '' } else { @('--KeyVaultSecretTags',			('"'+$KeyVaultSecretTags+'"'))  }
$arg4 =  if ([String]::IsNullOrEmpty($ThumbprintVariableName))				{ '' } else { @('--ThumbprintVariableName',			('"'+$ThumbprintVariableName+'"'))  }
$arg5 =  if ([String]::IsNullOrEmpty($SecretUriVariableName))				{ '' } else { @('--SecretUriVariableName',			('"'+$SecretUriVariableName+'"'))  }
$serviceEndpoint_0v0z5 = Get-ServiceEndpoint -Name "$ConnectedServiceName" -Context $distributedTaskContext
$ServicePrincipalId_0v0z5 = $serviceEndpoint_0v0z5.Authorization.Parameters.ServicePrincipalId
$ServicePrincipalKey_0v0z5 = $serviceEndpoint_0v0z5.Authorization.Parameters.ServicePrincipalKey
$TenantId_0v0z5 = $serviceEndpoint_0v0z5.Authorization.Parameters.TenantId
$azureSubscriptionId_0v0z5 = $serviceEndpoint_0v0z5.Data.SubscriptionId
$cwd =  Split-Path -parent $PSCommandPath
$CMD = "$cwd/ExtractCertificateInformationTask.exe"
& $CMD --TenantId $TenantId_0v0z5 --SubscriptionId $azureSubscriptionId_0v0z5 --PrincipalKey $ServicePrincipalKey_0v0z5 --PrincipalId $ServicePrincipalId_0v0z5 $arg0 $arg1 $arg2 $arg3 $arg4 $arg5

program.cs

using System.ComponentModel.DataAnnotations;
using System.Threading;
using System.Threading.Tasks;
using CommandLine;
using SInnovations.VSTeamServices.TasksBuilder.Attributes;
using SInnovations.VSTeamServices.TasksBuilder.AzureResourceManager.ResourceTypes;
using SInnovations.VSTeamServices.TasksBuilder.ConsoleUtils;
using SInnovations.VSTeamServices.TasksBuilder.KeyVault.ResourceTypes;
using SInnovations.VSTeamServices.TasksBuilder.Tasks;

namespace ExtractCertificateInformationTask
{
    [EntryPoint("Extract Certificate Information")]
    public class ProgramOptions

    {

        [Required]
        [Display(Name = "Service Principal", ShortName = "ConnectedServiceName", ResourceType = typeof(ServiceEndpoint), Description = "Azure Service Principal to obtain tokens from")]
        public ServiceEndpoint ConnectedServiceName { get; set; }
        
        public class ConnectedServiceRelation : PropertyRelation<ProgramOptions, ServiceEndpoint>
        {
            public ConnectedServiceRelation()
                : base(@class => @class.ConnectedServiceName)
            {

            }
        }

        [ConnectedServiceRelation(typeof(ConnectedServiceRelation))] //Allows the user to pick from dropdown of existing keyvaults/secrets
        [Display(GroupName = "KeyVault", ResourceType = typeof(KeyVaultOutput<ProgramOptions>))]
        public KeyVaultOutput<ProgramOptions> KeyVault { get; set; }


        [Option("ThumbprintVariableName", HelpText = "The variablename to output thumbprint into")]
        public string ThumbprintVariableName { get; set; }

        [Option("SecretUriVariableName", HelpText = "The variablename to output secret uri")]
        public string SecretUriVariableName { get; set; }
    }
    class Program
    {
        private static readonly CancellationTokenSource cancellationTokenSource = new CancellationTokenSource();
        private static readonly ManualResetEvent runCompleteEvent = new ManualResetEvent(false);

        static void Main(string[] args)
        {
#if DEBUG
            args = new[] { "--build" };
#endif
            try
            {
                RunAsync(args, cancellationTokenSource.Token).Wait();
            }
            finally
            {
                runCompleteEvent.Set();
            }

        }
        private static async Task RunAsync(string[] args, CancellationToken token)
        {
            var options = ConsoleHelper.ParseAndHandleArguments<ProgramOptions>("ExtractCertificateInformationTask", args);

            //   options.KeyVault.SaveCertificateAsync
            var secret = await options.KeyVault.KeyVaultClient.GetSecretAsync(options.KeyVault.VaultName, options.KeyVault.SecretName);


            if (!string.IsNullOrEmpty(options.ThumbprintVariableName)){
                TaskHelper.SetVariable(options.ThumbprintVariableName, secret.Tags["thumbprint"]);
            }
            if (!string.IsNullOrEmpty(options.SecretUriVariableName))
            {
                TaskHelper.SetVariable(options.SecretUriVariableName, secret.SecretIdentifier.Identifier);
            }
        }
    }
}

task.json

{
  "id": "2bd86829-a041-41c4-8632-a46e60af0698",
  "name": "ExtractCertificateInformationTask",
  "friendlyName": "Extract Certificate Information",
  "description": "Extract Certificate Thumbprint and SecretUri from keyvault",
  "category": "Utility",
  "visibility": [
    "Build",
    "Release"
  ],
  "demands": [
    "azureps"
  ],
  "author": "S-Innovations v/Poul Kjeldager Sørensen",
  "version": {
    "major": 1,
    "minor": 0,
    "patch": 0
  },
  "minimumAgentVersion": "1.92.0",
  "groups": [],
  "inputs": [
    {
      "name": "ConnectedServiceName",
      "type": "connectedService:AzureRM",
      "label": "Service Principal",
      "defaultValue": "",
      "required": true,
      "helpMarkDown": "Azure Service Principal to obtain tokens from",
      "properties": {
        "EditableOptions": "True"
      }
    },
    {
      "name": "KeyVaultName",
      "type": "pickList",
      "label": "KeyVault Name",
      "defaultValue": "",
      "required": false,
      "groupName": "KeyVault",
      "helpMarkDown": "The keyvault namespace",
      "properties": {
        "EditableOptions": "True"
      }
    },
    {
      "name": "SecretName",
      "type": "pickList",
      "label": "Secret Name",
      "defaultValue": "",
      "required": false,
      "groupName": "KeyVault",
      "helpMarkDown": "The keyvault secret name to store value in",
      "properties": {
        "EditableOptions": "True"
      }
    },
    {
      "name": "KeyVaultSecretTags",
      "type": "string",
      "label": "Secret Tags",
      "defaultValue": "",
      "required": false,
      "groupName": "KeyVault",
      "helpMarkDown": "Tags, seperate tags with comma and key:value with semicolon.",
      "properties": {
        "EditableOptions": "True"
      }
    },
    {
      "name": "ThumbprintVariableName",
      "type": "string",
      "label": "ThumbprintVariableName",
      "defaultValue": "",
      "required": false,
      "helpMarkDown": "The variablename to output thumbprint into",
      "properties": {
        "EditableOptions": "True"
      }
    },
    {
      "name": "SecretUriVariableName",
      "type": "string",
      "label": "SecretUriVariableName",
      "defaultValue": "",
      "required": false,
      "helpMarkDown": "The variablename to output secret uri",
      "properties": {
        "EditableOptions": "True"
      }
    }
  ],
  "instanceNameFormat": "Extract Certificate Information",
  "execution": {
    "PowerShell": {
      "target": "$(currentDirectory)\\OauthBroker.ps1",
      "workingDirectory": "$(currentDirectory)",
      "argumentFormat": ""
    }
  },
  "sourceDefinitions": [
    {
      "endpoint": "https://management.azure.com/subscriptions/$(authKey.SubscriptionId)/providers/Microsoft.KeyVault/vaults?api-version=2015-06-01",
      "target": "KeyVaultName",
      "authKey": "$(ConnectedServiceName)",
      "selector": "jsonpath:$.value[*].name",
      "keySelector": "jsonpath:$.value[*].id"
    },
    {
      "endpoint": "https://management.azure.com/$(KeyVaultName)/secrets?api-version=2015-06-01",
      "target": "SecretName",
      "authKey": "$(ConnectedServiceName)",
      "selector": "jsonpath:$.value[*].name",
      "keySelector": "jsonpath:$.value[*].id"
    }
  ]
}