The Agent Skills Directory

[Development Workflow and Script Execution]: The skill outlines a standard development process for the Aspire extension, requiring the execution of repository-local scripts such as build.sh and restore.sh, and commands like dotnet build and yarn run. These operations are typical for compiling and testing code within a trusted development environment.
[Secure Dependency Management]: The skill requires the use of a pinned package manager (yarn via Corepack) and specifies that dependencies must resolve through a private internal feed (dotnet-public-npm). This is a security-conscious pattern that helps protect against dependency confusion and supply chain risks.
[Data Ingestion Surface]: The instructions describe how the extension processes machine-readable output from the Aspire CLI (e.g., aspire config info) and manifest files. While any ingestion of external data represents a potential surface for indirect prompt injection, this is a standard design for developer tooling and is handled through regular project development practices.
[Sensitive Information Redaction]: The guide includes an explicit requirement for the agent to redact secrets, tokens, private paths, and usernames before providing evidence in pull requests. This is an important security best practice that prevents accidental data exposure.

vscode-extension