The Agent Skills Directory

Command Execution: The skill uses the Bash tool to execute build and test commands such as dotnet build, npm install, and npm run build. These are used to validate that the instrumentation does not break the project's build process.
External Downloads: The skill installs several packages from official registries (NuGet, NPM, PyPI). These include @microsoft/opentelemetry, Azure.Identity, and msal, which are well-known libraries from a trusted organization for telemetry and identity management.
Dynamic Execution of Local Code: During the smoke test phase, the skill executes the user's local project code in a background process (e.g., via npm start) to verify that telemetry spans are correctly exported. This is a potential area for review as it involves runtime execution of code in the local environment.
Indirect Prompt Injection Surface: The skill reads project configuration and source files (like package.json, .env, and source code) to detect the agent type and apply edits. This creates a surface where instructions embedded in those files could theoretically influence the agent's behavior, although no specific malicious patterns were detected.
Credential Handling: The skill generates and writes boilerplate code for token resolution (using MSAL) into the user's project. This code is designed to interact with Microsoft's authentication services to acquire tokens for telemetry export to the Microsoft Agent 365 backend.

instrument-observability