The Agent Skills Directory

Command Execution: The skill employs the wiqd CLI and Azure CLI (az) for core agent lifecycle operations, including scaffolding, validation, provisioning, and deployment. These tools are standard for the Microsoft 365 development ecosystem.
External Downloads and Execution: The skill uses npx to execute the mcp-remote-client utility for performing OAuth authentication with Model Context Protocol (MCP) servers. While this involves executing an external package, it is used within the intended scope of developer tooling.
Data Management and Security: Detailed guidance is provided for managing sensitive OAuth credentials. The instructions mandate storing secrets in local environment files (.env.*.user) that are excluded from version control and explicitly forbid the display of access tokens or client secrets in the conversation.
Dynamic Execution: The skill uses local Python scripts via shell heredocs to parse and extract tool definitions from MCP server responses, ensuring that agent capabilities are based on accurate service metadata.
Indirect Prompt Injection: The skill is designed to process external data, such as OpenAPI specifications and MCP tool lists. To mitigate risks from untrusted content, the skill requires running a validation command (wiqd agent validate) and provides a structured framework for auditing and improving agent instructions.

declarative-agent-developer