The Agent Skills Directory

Execution of Local Scripts: The skill relies on several bundled shell and PowerShell scripts (e.g., validate-deployment.sh, validate-terraform.sh, workflow.sh) to automate multi-step validation processes. These scripts interact with system-level tools like the Azure CLI and Terraform to verify environment state and infrastructure templates. This is a common pattern for complex automation tasks in AI skills.
Indirect Prompt Injection Surface: The skill processes various user-controlled files, including infrastructure-as-code templates (Bicep, Terraform), Dockerfiles, and C# source code. This represents an attack surface where instructions embedded in these files could theoretically influence the agent's behavior if not properly isolated.
Ingestion points: Project files such as azure.yaml, Dockerfile, main.bicep, main.tf, main.tfvars.json, and *.cs are read during validation steps as described in references/recipes/azd/README.md and references/recipes/terraform/README.md.
Boundary markers: The skill instructions do not explicitly define specific delimiters or "ignore instructions" warnings to isolate the content of these external files from the agent's core instructions.
Capability inventory: The skill has the capability to execute powerful CLI tools (az, azd, terraform, docker) and write validation status to the local .azure/validate-status.json file.
Sanitization: The skill largely relies on official third-party CLI tools to parse and validate complex file formats, supplemented by basic pattern matching using grep and sed in utility scripts like scan-aspire-functions-secrets.sh.
Static Analysis of Infrastructure: The skill performs detailed reviews of Bicep and Terraform code to identify potential RBAC misconfigurations and ensure least-privilege access, which is a key security feature for preventing deployment errors and unauthorized access.
Vendor-Provided Tooling: As a Microsoft-authored skill, it utilizes official Azure and Azure Developer CLI tools for its operations, aligning with recommended practices for Azure cloud management and deployment validation.

azure-validate