The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides tools to ingest data from external Azure DevOps sources, such as build logs, pull request comments, and wiki content. This functionality represents a standard surface for indirect prompt injection where malicious content within the DevOps environment could attempt to influence agent behavior.
Ingestion points: mcp__ado__pipelines_get_build_log, mcp__ado__repo_list_pull_request_threads, and mcp__ado__wiki_get_page_content as documented in SKILL.md.
Boundary markers: The skill does not explicitly define delimiters for external data ingestion.
Capability inventory: The skill allows for significant actions including triggering pipeline runs (mcp__ado__pipelines_run_pipeline), modifying source code via PRs, and executing shell commands through the allowed Bash tool.
Sanitization: No explicit content sanitization or validation logic is provided for external data before processing.
[COMMAND_EXECUTION]: The skill includes a Bash script (scripts/ado-cli.sh) and instructions to use the Bash tool to perform administrative tasks. This is consistent with the skill's purpose for DevOps automation and management.
[SAFE]: The skill implements authentication using Personal Access Tokens (PATs) passed via environment variables, avoiding hardcoded credentials. It interacts exclusively with well-known and trusted Microsoft Azure DevOps domains (dev.azure.com and almsearch.dev.azure.com).

azure-devops