The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes external data, including workload descriptions, existing infrastructure code (Bicep/Terraform), and resource metadata, which could potentially contain adversarial instructions designed to influence the agent's behavior.
Ingestion points: Data is ingested during Phase 1 (environment insights), Phase 2 (requirements gathering), and when handling referenced brownfield infrastructure.
Boundary markers: Security is maintained through manual plan approval in Phase 5 and a strict destructive action gate in Phase 7 that requires explicit user acknowledgement of risks after they are presented.
Capability inventory: The skill possesses the capability to execute Azure CLI commands (az deployment, az graph), Terraform operations, and file system modifications within the project directory.
Sanitization: Mitigation includes mandatory security scanning using Checkov in Phase 6 and enforcement of secure-by-default patterns, such as disabling public network access and using managed identities instead of connection strings.
Execution of Infrastructure Commands: The skill utilizes standard tools including the Azure CLI and Terraform to provision and manage cloud resources.
This functionality is essential to the skill's purpose and is protected by a gated pipeline that prevents execution without manual user confirmation and successful validation of the generated code.
External Data Retrieval: The skill fetches technical specifications, naming rules, and architectural guidance from official documentation sources.
[Security Consideration]: It utilizes MCP tools to search and fetch content from Microsoft Learn (a well-known service) to ensure that infrastructure plans comply with platform-enforced constraints and naming conventions.
Automated Security Scanning: The skill integrates the Checkov security scanner to review generated Infrastructure-as-Code (IaC) files.
This provides an automated layer of defense by identifying high and critical security misconfigurations in Bicep or Terraform files before any deployment is attempted.

azure-enterprise-infra-planner