The Agent Skills Directory

Dynamic Code Execution: The calibrate_grader.py script utilizes the exec() function to load and execute custom grading logic from a user-specified file. This is a security consideration if the tool is used to process untrusted code files.
Command Execution: Several scripts, including smoke_test_voice.py and deploy_model.py, use the subprocess module to invoke Azure CLI commands for authentication and resource provisioning.
External Resource Access: The skill fetches starter templates and code samples from official Microsoft and Azure sample repositories on GitHub to initialize project infrastructure. These sources are considered trusted within the specified environment.
Indirect Prompt Injection Surface: The skill facilitates the harvesting of production traces and evaluation results from Application Insights. The ingestion of this external data into the agent's context is identified as a potential surface for indirect prompt injection, as documented in the skill's safety guidelines.

microsoft-foundry