The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing various tools and libraries via standard package managers (winget, pip, dotnet, brew, npm). All suggested packages, such as Microsoft.FoundryLocal, wasdk-Microsoft.Windows.AI.MachineLearning, and torch-directml, are official resources from Microsoft or well-known organizations. References to external tools, such as the App Actions Testing Playground at aka.ms, use official Microsoft short-links.
[COMMAND_EXECUTION]: The skill includes command-line examples for managing local AI services and hardware profiling (foundry, odr.exe, wpr, gpuview). These are standard developer tools and their usage is appropriately documented for their intended purpose (inference management and performance analysis). Some commands, like diagnostic tracing, are correctly noted as requiring elevated privileges.
[DATA_EXFILTRATION]: No evidence of unauthorized data access or transmission was found. The local REST API and SDKs described operate in-process or on localhost by default. The documentation explicitly discusses privacy, noting that prompts and model outputs stay on the user's device during inference, and only metadata or explicitly granted files are processed.
[PROMPT_INJECTION]: The instructions are purely informative and do not contain any patterns attempting to override agent behavior or bypass safety filters. Instead, the documentation provides detailed guides on implementing safety features like ContentFilterOptions, user consent models, and Responsible AI principles to mitigate risks like prompt injection in user-developed applications.
[REMOTE_CODE_EXECUTION]: The skill describes legitimate workflows for downloading and running AI models from the Foundry Catalog and Windows ML Model Catalog. These processes include integrity verification using SHA256 hashes and are managed by official Microsoft runtimes in isolated environments (agent sessions).
[CREDENTIALS_UNSAFE]: No hardcoded credentials or sensitive file paths were detected. Code examples use standard placeholders for API keys and local file paths, and the documentation recommends using environment-specific configuration for sensitive data.

windows-ai