The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that direct the agent to disregard its memory or previous conversation context in favor of the current workspace state ("Never reuse role counts... from this skill, memory, a previous chat"). This pattern, while intended to ensure data accuracy, utilizes override techniques common in prompt injection.
[COMMAND_EXECUTION]: The skill utilizes the shell tool to perform a variety of operations including repository status checks with git, file searching with ripgrep (rg), and Azure infrastructure queries via az role assignment list. It also provides instructions for executing make targets that apply changes to Azure identity pools. The skill provides clear guidance on identifying destructive operations and requiring verification steps.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from local repository files which could potentially contain instructions that influence the agent's behavior.
Ingestion points: File content from Bicep templates (managed-identities.bicep), YAML configurations (e2e-slots.yaml), and documentation files in docs/ci/.
Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions when reading these external files into the agent's context.
Capability inventory: Access to the shell tool for running commands like git, rg, az, and make on the local system and against Azure APIs.
Sanitization: There is no evidence of explicit sanitization, validation, or filtering of the content read from the repository files before it is used in calculations or rollout plans.

aro-hcp-e2e-capacity