The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides the agent with the ability to retrieve and process content from various Microsoft 365 sources that may contain malicious instructions from external actors.
Ingestion points: Numerous commands in references/commands.txt read content from the environment, including outlook message list, teams message list, and spo file get (SharePoint documents).
Capability inventory: The skill has extensive administrative capabilities, including user management (entra user), site administration (spo site), and application permission control (entra app permission).
Boundary markers: No explicit delimiters or instructions are provided in SKILL.md to prevent the agent from following instructions embedded in the retrieved data.
Sanitization: The skill does not define any validation or sanitization steps for the data fetched from Microsoft 365 before it is included in the agent's context.
[COMMAND_EXECUTION]: The skill exposes a powerful command-line interface with capabilities that could be abused for data exfiltration if the agent is compromised. For example, util accesstoken get allows the retrieval of authentication tokens, and the request or adaptivecard send commands could be used to transmit sensitive data to external servers.

clim365