The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes curl and curl.exe to perform HTTP requests to the Azure DevOps REST API. These commands are used solely for data retrieval purposes and are scoped to the organization and project specified by the user.
[CREDENTIALS_UNSAFE]: The skill demonstrates high security awareness regarding sensitive information. It includes explicit instructions to handle the AZURE_DEVOPS_PAT via environment variables, specifically forbidding the agent from printing the token, writing it to persistent files, or asking the user to provide it directly within the chat interface.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data (test plan names, test suite descriptions, and tester names) from the Azure DevOps API.
Ingestion points: Data is fetched from multiple Azure DevOps REST API endpoints (e.g., /plans, /suites, /TestPoint) as described in SKILL.md.
Boundary markers: The instructions do not define explicit data delimiters; however, the data is formatted into structured Markdown tables for the final report.
Capability inventory: The skill uses curl for network requests to a trusted service and creates temporary JSON files when running in PowerShell environments.
Sanitization: The skill does not explicitly mention sanitizing or escaping the text retrieved from the API before rendering it in the final report.
[EXTERNAL_DOWNLOADS]: The skill fetches data from dev.azure.com, which is a well-known service. These operations are essential to the skill's function and do not involve downloading or executing arbitrary scripts from untrusted sources.

test-plans-progress