The Agent Skills Directory

[SAFE]: The skill's primary function is to generate .tour files, which are structured JSON documents used by the VS Code CodeTour extension. It does not perform any administrative actions or code modifications.
[DATA_EXPOSURE & EXFILTRATION]: The skill references legitimate external resources, including a schema hosted on a Microsoft domain (aka.ms) and example links to GitHub. These are well-known, trusted services used for their intended documentation purposes.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent not to modify source code, limiting its actions to creating documentation files in the .tours/ directory.
[INDIRECT_PROMPT_INJECTION]: The skill involves reading and verifying file paths and line anchors within a local repository. While it processes untrusted data (repository content), the output is constrained to a fixed JSON schema, which significantly mitigates the risk of instructions embedded in the code influencing the agent's behavior beyond the intended documentation task.

code-tour