The Agent Skills Directory

[METADATA_POISONING]: The metadata in SKILL.md explicitly claims the author is "Microsoft" (author: Microsoft), which contradicts the provided developer context identifying the author as "attentiondotnet". This discrepancy is deceptive and mimics a trusted vendor to bypass user scrutiny.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and analyze logs and resource statuses (e.g., kubectl logs, az containerapp logs show, az monitor app-insights query). This creates a vulnerability surface for indirect prompt injection, as an attacker who can influence log content could embed instructions that manipulate the agent's diagnostic logic.
Ingestion points: references/functions/README.md, references/container-apps/README.md, aks-troubleshooting/pod-failures.md.
Boundary markers: Absent in instructions.
Capability inventory: Extensive CLI and K8s command execution.
Sanitization: Not present in the instruction set.
[PROMPT_INJECTION]: The skill uses authoritative override language, such as "AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE" and "official source," to prioritize its instructions over the agent's default safety guidelines or system prompts.
[COMMAND_EXECUTION]: The skill provides numerous complex commands for az and kubectl. While intended for diagnostics, the retrieval of sensitive secrets like APPLICATIONINSIGHTS_CONNECTION_STRING or instrumentationKey (found in references/functions/README.md) increases the risk of data exposure if the agent is not properly constrained.

azure-diagnostics