The Agent Skills Directory

Indirect Prompt Injection Surface: The skill ingests untrusted project metadata to drive framework detection and manifest generation.
Ingestion Points: The skill scans signal files like package.json, pom.xml, and requirements.txt in the user's project directory to detect the technology stack (references/detection.md).
Capability Inventory: The detected metadata is used to populate infrastructure templates and execute deployment commands via the Azure CLI (az) and kubectl (phases/quick-deploy.md).
Boundary Markers: Instructions advise the agent to scan the project and ask for clarification if configurations are ambiguous.
Sanitization: The skill relies on template-based generation and includes a post-generation validation step against formal security safeguards.
External Resource Reference: The skill references external deployment manifests from a well-known, trusted source.
Pattern: The workflow recommends downloading Gateway API Custom Resource Definitions (CRDs) from the official kubernetes-sigs GitHub repository if they are not already present in the cluster (phases/quick-deploy.md).
Context: This is a standard administrative procedure for configuring advanced routing in Kubernetes and utilizes a trusted organization within the ecosystem.
Security Policy Enforcement: The skill incorporates an automated security validation layer to protect the deployment target.
Pattern: It automatically checks generated manifests against the AKS Deployment Safeguards (rules DS001–DS013), such as requiring resource limits and non-root users (references/safeguards.md).
Impact: This proactive approach reduces the risk of misconfigured or insecure containers reaching the production cluster.
Authentication Best Practices: The skill prioritizes secure, passwordless authentication methods.
Pattern: It encourages the use of Azure Workload Identity to allow applications to authenticate to Azure services using short-lived OIDC tokens instead of hardcoded credentials (references/workload-identity.md).
Pattern: The provided CI/CD templates use GitHub OIDC federation to authenticate with Azure, eliminating the need for stored client secrets (templates/github-actions/deploy.yml).

azure-kubernetes-app-deploy