The Agent Skills Directory

[Robust Path Containment]: The component-copy scripts (PowerShell and Bash) perform extensive validation to ensure that file writes are restricted to the user's project directory. The installer re-verifies containment immediately before each write, preventing directory traversal or escapes.
[Symbolic Link and Junction Protections]: The scripts explicitly detect and refuse to process symbolic links or Windows directory junctions in both the source and target paths. This mitigation prevents link-following attacks that could result in unauthorized file access or writes.
[Secure Subprocess Execution]: Integration with local tools like git, jq, and the VS Code CLI is handled through restricted command sets and safe argument passing. For example, the validate-extension scripts use an allow-list for the CLI command name and fixed arguments to prevent command injection.
[Trusted Repository Downloads]: The installer fetches the HVE-Core source from official Microsoft GitHub repositories (github.com/microsoft/hve-core). The instructions include advisory checks to verify the repository origin before proceeding with installation.
[Input Ingestion Surface]: As an installer, the skill processes local files such as plugin.json and various component files. While this creates a potential surface for indirect prompt injection, the skill mitigates this by applying strict schema validation and authorization guardrails before modifying any local configuration.

hve-core-installer