The Agent Skills Directory

Command Execution: The skill executes shell commands using subprocess.run to interact with the Microsoft 365 Agents Toolkit (atk). This is a central feature for packaging and validating plugins. The implementation demonstrates security awareness by setting shell=False and sanitizing the PATH environment variable to ensure only trusted system binaries are used, which effectively mitigates common command injection and binary substitution risks.
External Downloads: The skill utilizes npx to download and run the @microsoft/m365agentstoolkit-cli package from the official NPM registry. These downloads target a pinned version of a package from a well-known, trusted organization (microsoft). This is a standard and safe practice for providing up-to-date developer tooling while maintaining a minimal local footprint.
Processing Untrusted Archives: The skill includes specialized logic for safely inspecting and extracting ZIP archives. It implements several defensive measures, including limits on extraction size and file counts to prevent resource exhaustion, and strict path validation to prevent directory traversal. By rejecting symbolic links within archives, the skill ensures that extracted content remains confined to a secure temporary workspace.
Indirect Prompt Injection Surface: As a developer tool, this skill ingests and analyzes project files and manifest data provided by the user. While this creates a surface for indirect prompt injection, the skill mitigates this by focusing on structural and schema validation. It does not execute instructions found within the project data, treating user-supplied text primarily as data to be validated against predefined rules.

cowork-plugin-engineer