The Agent Skills Directory

Indirect Prompt Injection Surface: The skill is designed to process external configuration files (e.g., via the --fixed-arguments-file argument) and documents during qualification. If these files were to contain unexpected instructions, they could potentially influence the agent's behavior. The skill includes a mitigating instruction to use 'explicitly reviewed values' and 'trusted absolute JSON-object' files for these operations.
Local Package Installation: The instructions refer to installing an 'assembled package' located within the project's relative directory structure (../../addin/). This is a routine procedure for setting up local extensions and refers to components provided as part of the skill's own local environment rather than untrusted remote sources.
Authentication Guidance: The skill includes explicit security guidelines for authentication, instructing the agent to let the user complete sign-in URLs and forbidding the collection of passwords or the copying of credentials.

setup-autodesk-fusion