The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill documentation includes example build commands that contain hardcoded placeholder credentials.
Evidence: The file SKILL.md contains a signtool command using /p password and a PowerShell command using -String "password" for certificate handling.
[INDIRECT_PROMPT_INJECTION]: The skill presents a vulnerability surface for indirect prompt injection because it interpolates user-provided metadata into generated XML and YAML configuration files.
Ingestion points: Data from the appInfo and executables input fields in SKILL.md is ingested and placed directly into file templates.
Boundary markers: There are no explicit delimiters or specific instructions for the agent to treat the user-supplied strings as non-executable text within the manifest or CI/CD templates.
Capability inventory: The skill is authorized to use Write and Edit tools to create sensitive files such as the Package.appxmanifest and GitHub Actions workflow files.
Sanitization: No sanitization or escaping mechanisms are described for processing the appInfo fields before they are written to disk.
[EXTERNAL_DOWNLOADS]: The CI/CD templates generated by the skill reference official GitHub Actions for building and signing the application.
Evidence: The GitHub Actions template in SKILL.md references official repositories including actions/checkout@v4, actions/setup-dotnet@v4, and actions/upload-artifact@v4.

msix-package-generator