The Agent Skills Directory

Handling of Authentication Credentials: The skill provides instructions for configuring sensitive credentials such as clientSecret and clientId using environment variables. While this is a standard practice for secure local development, it is important to ensure that these configurations are correctly managed to prevent credential exposure.
External Dependency Installation: The documentation recommends the installation of external tools like agentsplayground and npm-run-all for development and testing workflows. Users should verify the integrity and source of these packages when adding them to their development environment.
Indirect Prompt Injection Surface: The skill describes building agents that ingest and process user messages. As with any agent that processes untrusted external data, there is an inherent risk of indirect prompt injection. Evidence chain: (1) Ingestion point: ctx.activity.text in SKILL.md; (2) Boundary markers: Not explicitly shown; (3) Capabilities: Network access via authentication tokens and storage backends; (4) Sanitization: Not explicitly addressed.
Validation Command Execution: The skill includes commands intended for validating registration and connectivity to official endpoints. These are legitimate troubleshooting tools but involve network communication with external services.

agents-sdk-typescript