The Agent Skills Directory

Command Execution: The skill executes pac copilot commands to pull and push agent configurations. This is the intended function of the skill, enabling developers to sync local changes with the Copilot Studio cloud environment using official Microsoft CLI tools.
Input Sanitization and Injection Prevention: The skill provides a rigorous framework for handling user-supplied paths, instructing the agent to reject control characters and use single-quoted arguments with proper escaping. These measures are designed to mitigate potential shell injection vulnerabilities.
Least Privilege and Workspace Integrity: By requiring the presence of specific metadata files (.mcs/conn.json) and project files before execution, the skill ensures it only operates on intended workspaces. It also explicitly forbids the AI from directly modifying internal metadata files, maintaining the integrity of the PAC synchronization state.
Authentication Best Practices: The skill leverages the native pac auth create command for identity management, which is the recommended security practice for interactive CLI authentication in the Power Platform ecosystem.

push-agent