The Agent Skills Directory

Automated Command Execution: The skill utilizes various command-line tools, including az, gh, npm, and git, to query external APIs and perform repository actions. These tools are used to facilitate the automation of security patching tasks.
External Data Ingestion: It fetches vulnerability data from official sources, specifically Azure DevOps boards and GitHub Dependabot alerts. This involves ingesting external information (such as alert titles and package names) which is a standard part of the security auditing process.
Dynamic Configuration Modification: The skill uses inline Node.js scripts to programmatically edit the package-lock.json file. This is a targeted approach used to apply specific security patches to dependencies.
Indirect Prompt Injection Surface: Because the skill processes data from external work items and security advisories, there is a theoretical surface for indirect prompt injection. The skill manages this by using structured data queries and focusing on specific fields required for patching.
Local Resource Access: It reads and writes to local project files like package.json and package-lock.json to apply fixes and verify the build, which is consistent with its stated functionality.

security-alerts