The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill ingests data from external sources and internal project files to generate code, which could potentially be manipulated by malicious content in those sources.\n
Ingestion points: Fetches documentation via the Microsoft Learn search and fetch tools (Phase 3) and analyzes the local site source code using the Explore agent (Phase 1.4).\n
Boundary markers: The skill relies on human-in-the-loop approval gates, such as the mandatory review of the implementation plan (Phase 4), to verify the generated logic before it is committed.\n
Capability inventory: The agent has permissions to write and edit files, execute shell scripts, and use Playwright tools to interact with the deployed site for troubleshooting.\n
Sanitization: A validation script (scripts/validate-serverlogic.js) performs static analysis on generated code to detect and block prohibited patterns, such as browser APIs or CommonJS exports, before the process completes.\n- [Trusted Vendor Resources]: The skill interacts with official documentation and cloud management platforms belonging to the vendor.\n
External References: It fetches technical documentation from learn.microsoft.com and provides workflows for managing secrets via portal.azure.com and Azure CLI. These are established, well-known services provided by the vendor (Microsoft) for the intended purpose of the skill.\n- [Secure Secret Handling]: The skill follows security best practices for credential management.\n
Pattern: It explicitly instructs the agent never to request secret values directly from the user. Instead, it provides copy-pasteable commands and manual steps for the user to securely provision secrets into Azure Key Vault or Dataverse environment variables, ensuring credentials are never exposed in the conversation history or source code.

add-server-logic