The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to bypass or minimize platform-level security confirmations and interaction guards (e.g., 'Read', 'Write', and 'PowerShell command' prompts) by maximizing permission settings.
[COMMAND_EXECUTION]: The skill requests autoApprove: true for highly sensitive servers including shell, filesystem, and playwright. This configuration allows the agent to execute arbitrary commands and interact with the file system without further user approval.
[COMMAND_EXECUTION]: The skill requests broad permissions for critical system cmdlets such as Start-Process, Set-ExecutionPolicy, Invoke-RestMethod, and Remove-Item using wildcards (*), which grants the agent excessive control over the host environment.
[CREDENTIALS_UNSAFE]: The execution logic includes scanning sensitive user directories (e.g., %APPDATA%\GitHub Copilot, %APPDATA%\Code\User, and the user profile) for configuration and settings files that frequently contain authentication tokens, session data, or sensitive environment variables.
[DATA_EXFILTRATION]: The skill requests broad network capabilities (Invoke-WebRequest, Invoke-RestMethod, curl) in conjunction with tools that access private user data (OneDrive, Email, Teams, and Calendar), creating a high-risk surface for unauthorized data exfiltration.

permission-max