The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx -y @softeria/ms-365-mcp-server to download and execute an external package from the NPM registry at runtime.
[COMMAND_EXECUTION]: The skill invokes the @softeria/ms-365-mcp-server package as a shell command to start the MCP server, passing configuration flags and tool filters.
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes external data from Microsoft 365 which could contain malicious instructions.
Ingestion points: Fetches folder contents, item metadata, version history, and sharing permissions from OneDrive and SharePoint via the list-folder-files, get-drive-item, and list-drive-item-permissions tools.
Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided in the workflow.
Capability inventory: The skill is configured with a --read-only flag, limiting the agent's actions to data inspection (metadata, versions, permissions) without write or delete capabilities.
Sanitization: The instructions do not specify any validation or sanitization steps for the data retrieved from the Graph API before it is presented to the agent.

msgraph-files