The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill relies on official, well-known Microsoft Azure libraries (azure-monitor-query and azure-identity) for its core functionality. These are trusted packages within the developer ecosystem for interacting with cloud infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external Azure Log Analytics workspaces.
Ingestion points: scripts/agent.py retrieves telemetry and audit data via the LogsQueryClient.query_workspace method.
Boundary markers: None are explicitly defined, as the skill operates on structured log data rather than free-form natural language prompts.
Capability inventory: The script performs local file writes to save a JSON report (azure_threat_report.json) using json.dump.
Sanitization: The retrieved log content is mapped into dictionaries and written to a static file without being passed to a shell or used to construct new executable commands, effectively neutralizing the risk of instruction execution from the ingested logs.

analyzing-azure-activity-logs-for-threats