The Agent Skills Directory

[External Downloads]: The skill facilitates the installation of OpenTelemetry and Microsoft-specific telemetry packages from the NPM registry. It also provides a script to pull the aspire-dashboard Docker image from the Microsoft Container Registry (mcr.microsoft.com). These downloads originate from trusted organizations and are necessary for the skill's primary purpose of providing observability.
[Command Execution]: The skill utilizes command-line tools such as npm and docker to set up the development environment. For instance, assets/start-aspire-dashboard.ps1 executes docker run to start a local monitoring dashboard. These commands are typical for developer-focused skills and include security considerations like binding to the 127.0.0.1 loopback address to prevent external access.
[Data Exposure Safeguards]: The instructions contain detailed guidelines to prevent the exfiltration of sensitive information. It explicitly prohibits including message text, prompts, tokens, authorization headers, cookies, or secrets in custom telemetry signals by default, which is a key security best practice.
[Indirect Prompt Injection Surface]: As the skill involves processing and displaying telemetry data (traces, metrics, and logs), it creates a surface where the agent might ingest untrusted data from an application's execution path. However, the risk is mitigated by the skill's instructions to filter sensitive content and the inherent nature of telemetry as operational metadata.
Ingestion points: The Aspire Dashboard UI (reading application signals) and src/instrumentation.ts (capturing traces/metrics).
Boundary markers: The skill advises implementing filtering to exclude sensitive data from signals, though explicit delimiters in the dashboard UI are not specified.
Capability inventory: npm install (SKILL.md) and docker run (assets/start-aspire-dashboard.ps1).
Sanitization: The skill mandates the omission of PII, tokens, and secrets from telemetry records.

agents-sdk-typescript-otel