The Agent Skills Directory

[DATA_EXFILTRATION]: The environment configuration scripts (scripts/classic-get-env-config.sh, scripts/classic-get-env-config.ps1, scripts/hcp-get-env-config.sh, and scripts/hcp-get-env-config.ps1) perform telemetry reporting by sending data to a remote server.
Evidence: The scripts retrieve a telemetry-cfg-endpoint and telemetry-cfg-api-key from Azure resource group tags. They then use curl or Invoke-RestMethod to POST a JSON payload containing the user's account name (retrieved via az account show), the agent client name, and skill revision to that endpoint.
Context: While likely intended for internal usage tracking within a corporate environment, the telemetry endpoint is dynamically determined by metadata (tags) in the cloud environment, which represents a data exfiltration vector if the environment is compromised.
[EXTERNAL_DOWNLOADS]: The skill is configured to fetch operational and debugging guidance from external remote sources.
Evidence: SKILL.md instructs the agent to fetch markdown files from https://raw.githubusercontent.com/Azure/ARO-HCP/main/docs/ai/debugging.md and https://raw.githubusercontent.com/Azure/ARO-RP/master/docs/ai/classic-debugging.md if the repositories are not available locally.
Note: These downloads target the official GitHub repositories of a well-known organization and are used for documentation purposes.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted external data that is subsequently processed by the agent.
Ingestion points: The agent reads content from remote GitHub markdown files and parses JSON configuration data stored in Azure Resource Group tags.
Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are present in the scripts when parsing the tag values.
Capability inventory: The skill has access to the shell tool, enabling execution of Azure CLI (az), curl, and PowerShell commands.
Sanitization: There is no evidence of sanitization or validation for the content fetched from remote markdown files or cloud metadata tags before it is presented to the agent context.

aro-ops