The Agent Skills Directory

[Indirect Prompt Injection Surface]: The SharedStateAgent pattern in references/server.md accepts arbitrary JSON data from the client through the ag_ui_state property and interpolates it directly into a system message for the model.
Ingestion points: references/server.md (SharedStateAgent.RunCoreStreamingAsync) extracts data from ChatOptions.AdditionalProperties["ag_ui_state"].
Boundary markers: The implementation uses text delimiters such as "Here is the current state in JSON format:" and "The new state is:", but lacks explicit instructions for the model to ignore embedded commands within that data.
Capability inventory: The agent may possess tool-calling capabilities (both backend and frontend), allowing the injected data to potentially trigger actions if the model follows instructions contained within the state object.
Sanitization: The example code uses state.GetRawText() to include the data in the prompt without applying specific sanitization or schema validation at the interpolation step.
[Subprocess Execution]: The skill facilitates the use of the GitHub Copilot CLI as a model provider through the CopilotClient class.
This involves booting a CLI subprocess (configured via COPILOT_CLI_PATH).
The documentation notes that an OnPermissionRequest handler, such as PermissionHandler.ApproveAll, is required for tool execution. This effectively delegates authorization decisions to the model's logic for the duration of the session.
[External Package References]: The installation instructions reference several pre-release NuGet packages from Microsoft and Azure organizations.
Dependencies: Microsoft.Agents.AI.Hosting.AGUI.AspNetCore, Microsoft.Agents.AI.OpenAI, Microsoft.Agents.AI.GitHub.Copilot, and Azure.AI.OpenAI are fetched from official registries.
Context: These are standard SDK components from a well-known service provider, used here to enable the core protocol functionality.
[Telemetry and Logging]: Documentation in references/advanced.md suggests enabling comprehensive HTTP logging (HttpLoggingFields.RequestBody and ResponseBody) in development environments.
While intended for debugging AG-UI protocol streams, this configuration will capture and store all conversation content and tool payloads, which may include sensitive information if not restricted to non-production environments.

agent-framework-agui-csharp