The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains deceptive metadata, claiming the author is "Microsoft" in the SKILL.md file, which contradicts the actual provider "kinnekate-hub." This social engineering tactic could mislead users into trusting the skill's actions as official vendor instructions. Furthermore, the skill is susceptible to indirect prompt injection because it reads and processes untrusted project files (e.g., azure.yaml, Bicep/Terraform templates, and source code) to guide its validation steps.
Ingestion points: Configuration and infrastructure files such as azure.yaml, *.bicep, *.tf, package.json, and Dockerfiles.
Boundary markers: No delimiters or safety warnings are implemented when the agent reads or processes these external files.
Capability inventory: The skill utilizes powerful CLI tools including 'az', 'azd', 'terraform', 'npm', and 'docker', which can perform network requests and manage cloud resources.
Sanitization: There is no evidence of content sanitization or validation for data extracted from project files before it is passed to system commands.
[COMMAND_EXECUTION]: The validation logic involves executing a wide range of shell commands. Some recipes (notably in references/recipes/azd/aspire.md) use command substitution and subshells to inject values retrieved from the environment or files into subsequent commands. This creates a surface for command injection if the project metadata or environment variables are maliciously crafted.
[EXTERNAL_DOWNLOADS]: The skill's recipes instruct the agent to perform operations like 'npm install --package-lock-only' and 'terraform init'. These operations download external packages and providers based on the project's configuration. When run against an untrusted or compromised project, this can result in the execution of malicious scripts or the installation of compromised dependencies.

azure-validate