The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external command-line interfaces to retrieve administrative data.
Evidence: The scripts audit-tenant-settings.py and generate_audit_pdf.py use subprocess.run to call ms-fabric-cli (fab) and the Azure CLI (az).
Context: These calls are restricted to retrieving configuration and security group metadata necessary for the audit functionality.
[DYNAMIC_EXECUTION]: One of the reporting scripts dynamically loads a local module to share logic.
Evidence: generate_audit_pdf.py uses importlib.util to import its sibling script audit-tenant-settings.py.
Context: This is used to maintain code re-use between the markdown and PDF report generators while working with hyphenated filenames that are not standard Python identifiers. The loading is limited to a hardcoded local file path.
[INDIRECT_PROMPT_INJECTION]: The skill processes external API data which could serve as a vector for indirect prompt injection.
Ingestion points: Data is ingested from Fabric Admin APIs and Entra ID Graph APIs via the fab and az tools.
Boundary markers: The generated reports do not use specific boundary delimiters (like XML tags) to encapsulate potentially untrusted API data when presenting it to the agent.
Capability inventory: The skill has the capability to execute shell commands and write to local cache files.
Sanitization: The scripts perform structured parsing of JSON data into internal data structures before rendering them into reports, providing a layer of validation.

audit-tenant-settings