The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the azure-devops-pp-cli and an associated MCP server using npx and go install. These resources are hosted on the @mvanhorn NPM organization and the mvanhorn/printing-press-library GitHub repository. As these resources belong to the identified vendor, the downloads are considered legitimate functional requirements.
[COMMAND_EXECUTION]: The core functionality of the skill relies on executing the azure-devops-pp-cli binary. This binary performs read and write operations on Azure DevOps data and interacts with a local SQLite database.
[DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> parameter that allows command output to be POSTed to an arbitrary external URL. This provides a functional mechanism for data exfiltration if an agent is manipulated into sending sensitive data to an attacker-controlled endpoint. Additionally, the feedback mechanism can send data to an external endpoint if specifically configured via environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external, untrusted sources within Azure DevOps, creating an attack surface for indirect prompt injection.
Ingestion points: Data ingested from Azure DevOps work items, pull request descriptions, commit messages, and build logs (SKILL.md).
Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions within the ingested data.
Capability inventory: The skill can write to the local file system (--deliver file:<path>), make network requests (--deliver webhook:<url>), and execute various subcommands within the CLI.
Sanitization: There is no mention of sanitization or validation of the content retrieved from external APIs before it is processed by the agent or the CLI.

pp-azure-devops