The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a specific shell script block to resolve the PLUGIN_ROOT path in the SKILL.md file. While intended for environment configuration, this is an explicit command execution pattern.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could contain malicious instructions designed to influence the agent's behavior.
Ingestion points: The skill fetches work item descriptions, comments, and attachments from Azure DevOps (references/azure-devops.md) and content from external URLs using the Chrome MCP (references/migrate/flow.md). It also analyzes project code and metadata.
Boundary markers: While the skill uses templates and mentions HTML normalization, it lacks explicit delimiters to distinguish untrusted external content from system instructions.
Capability inventory: The agent can write files and directories to the local repository, including research reports and new feature specifications (FT-XXX).
Sanitization: The skill performs HTML-to-markdown normalization for data retrieved from Azure DevOps, which provides a layer of sanitization but does not prevent prompt injection.
[EXTERNAL_DOWNLOADS]: The skill relies on external network operations via MCP tools to fetch data from Azure DevOps and arbitrary web URLs provided during migration analysis.

work-research