The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests text data from Azure DevOps APIs that could contain malicious instructions.
Ingestion points: The skill reads wiki page content (scripts/wiki.py), work item descriptions (scripts/work_items.py), and pull request metadata (scripts/repos.py).
Boundary markers: No boundary markers or 'ignore' instructions are used when interpolating this data into the agent's context.
Capability inventory: High-impact actions including approving deployments (scripts/environments.py), running pipelines (scripts/pipelines.py), and completing pull requests (scripts/repos.py).
Sanitization: No sanitization or filtering is performed on text content retrieved from external APIs.
[CREDENTIALS_UNSAFE]: The authentication management script provides a way to expose raw session secrets.
Evidence: The scripts/auth.py file includes a token command that retrieves the active OAuth access token or Personal Access Token (PAT) from the system keyring and prints it directly to standard output.
[COMMAND_EXECUTION]: The attachment download functionality allows for unrestricted file writes to the local system.
Evidence: The download function in scripts/attachments.py accepts an arbitrary output_path parameter from the CLI and writes the downloaded content to that path using open(output_path, "wb"). An attacker could exploit this by instructing the agent to overwrite sensitive local files like SSH keys or shell profiles.

azure-devops