The Agent Skills Directory

[DATA_EXFILTRATION]: The PowerShell and Bash sync scripts acquire a sensitive OAuth2 access token for the https://ai.azure.com/ resource using the az CLI. This token is then transmitted in the Authorization header to the $ProjectEndpoint URL provided by the user. Because the skill does not validate that the endpoint belongs to the official Azure AI Foundry service, a malicious prompt or compromised manifest could trick the agent into sending the token to an attacker-controlled server.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local JSON manifest files (e.g., foundry-agents.json) which define agent behaviors and system prompts.
Ingestion points: The agent is instructed to search for and read JSON manifest files at common paths such as infra/foundry-agents.json or .foundry/agents.json in the local repository.
Boundary markers: The skill lacks explicit boundary markers or instructions to treat the contents of the baseInstruction field as untrusted data.
Capability inventory: The skill possesses the capability to perform network POST operations (Invoke-RestMethod in PowerShell, curl in Bash) to external APIs.
Sanitization: The skill performs no sanitization or validation of the instructions read from the manifest before synchronizing them to the Foundry service, allowing a malicious manifest to inject instructions that alter the behavior of deployed agents.
[DYNAMIC_EXECUTION]: The skill generates (scaffolds) PowerShell and Bash scripts from templates and subsequently instructs the agent to execute them. While these scripts are generated from known templates within the skill, the execution of dynamically created scripts involving network access and credential handling represents a risk if the generation process is influenced by untrusted input.
[COMMAND_EXECUTION]: The skill relies on the execution of local system commands, specifically the az (Azure CLI) for authentication and token acquisition, and PowerShell scripts for orchestration.

foundry-agent-sync