The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and installs binaries using npx -y @mvanhorn/printing-press-library and go install github.com/mvanhorn/printing-press-library/.... These sources match the stated author context and use well-known service registries (NPM and GitHub).
[DATA_EXFILTRATION]: The CLI tool supports a --deliver webhook:<url> flag, which allows the agent to POST command results (potentially containing sensitive Azure DevOps data such as work items, PR details, or build logs) to arbitrary external URLs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external sources.
Ingestion points: Reads Azure DevOps work items, pull request titles/descriptions, and build logs (SKILL.md).
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to ignore embedded instructions within the ingested data.
Capability inventory: The agent has access to the Bash tool and the CLI can perform file writes (--deliver file:) and network requests (--deliver webhook:).
Sanitization: No sanitization or validation of the ingested ADO content is documented.
[COMMAND_EXECUTION]: The skill frequently invokes the azure-devops-pp-cli binary with various subcommands and user-influenced arguments, which is its primary intended functionality.

pp-azure-devops