The Agent Skills Directory

[PROMPT_INJECTION]: The skill metadata and documentation claim the author is 'Microsoft' and link to official Microsoft GitHub repositories and documentation. However, the platform indicates the skill is authored by 'kilo-org'. This discrepancy constitutes metadata poisoning and impersonation intended to gain undue trust from users.
[DATA_EXFILTRATION]: The auditing workflow for Azure Key Vault in 'references/azure-keyvault-expiration-audit.md' instructs the agent to retrieve full secret details, including plaintext values, using tools such as 'keyvault_secret_get' and 'az keyvault secret show'. This is a high-risk data exposure pattern because expiration dates are available in metadata-only 'list' operations; fetching the actual secret values is unnecessary for compliance auditing and exposes sensitive credentials to the agent context.
[COMMAND_EXECUTION]: The skill contains logic for generating and suggesting the execution of CLI commands, PowerShell loops, and Azure Resource Graph queries. While intended for remediation, this capability allows the agent to construct and execute complex scripts against the user's cloud environment.
[PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by instructing the agent to ingest and analyze output from external tools (azqr) and cloud resource properties. Maliciously configured resource names or tags in a scanned environment could be used to deliver instructions that manipulate the agent's audit findings or subsequent actions.

azure-compliance