The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Azure Pipelines YAML files provided by the user, creating a surface for indirect injection.
Ingestion points: scripts/validate_azure_pipelines.sh and scripts/validate_syntax.py read content from files provided via user input.
Boundary markers: The skill does not currently implement explicit boundary markers or instructions to ignore embedded commands within the ingested YAML data.
Capability inventory: The skill has the ability to execute bash/python scripts, perform file system operations (read/write), and access the network (via pip in the wrapper).
Sanitization: The Python logic correctly uses yaml.safe_load() to prevent unsafe object reconstruction during YAML parsing.
[EXTERNAL_DOWNLOADS]: The scripts/python_wrapper.sh script installs pyyaml and yamllint from the official Python Package Index (PyPI) if they are missing. These are standard, well-known development tools and libraries.
[REMOTE_CODE_EXECUTION]: Security scanners detected curl | bash patterns in scripts/test_regressions.py and multiple files in the examples/ directory. Analysis confirms these are static strings used as test cases for regression testing and are not executed by the skill's operational logic.
[COMMAND_EXECUTION]: The skill executes various local commands including bash, python3, git, and yamllint. These operations are consistent with the skill's documented purpose as a local validation tool.

azure-pipelines-validator