The Agent Skills Directory

[Command Execution]: The skill invokes the Azure CLI (az) using the subprocess module with shell=False. This method is used for authenticating the operator and managing Azure resources. Using list-style arguments and avoiding shell execution are standard practices to prevent potential command-handling issues.
[Credential Management]: The tool includes functions for retrieving Azure AI Service keys through official APIs. It employs a dedicated redaction system and validation checks to ensure that these credentials do not appear in logs or accidental output, maintaining the privacy of service keys during configuration tasks.
[Sandboxed Document Assessment]: When assessing the structure of local files, the skill utilizes an isolated worker process. This process is restricted by memory and CPU limits and employs Python audit hooks to block network operations, further subprocess creation, and unauthorized file modifications. This provides a defensive layer when handling untrusted document content.
[Private Artifact Storage]: The skill enforces privacy for its operation 'receipts' by using platform-specific security APIs to ensure the storage directories are user-owned and have restricted access permissions. It also verifies the integrity of these files using SHA-256 digests to prevent tampering.
[Data Ingestion Surface]: As the skill is designed to make local and cloud documents searchable, it naturally interacts with untrusted data. This ingestion surface is managed by the aforementioned sandboxing techniques and by limiting the types of operations permitted on retrieved knowledge base content.

foundry-iq