The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script uses importlib.util to dynamically load and execute the ask_teams_agent.py module. While it defaults to a sibling directory, the file path is determined by the --teams-script argument, allowing the execution of arbitrary Python files if the input is manipulated.
[COMMAND_EXECUTION]: The skill uses subprocess.run() to forward commands to a local forensic script (query_sessions.py). This allows the agent to trigger secondary process execution on the host system.
[DATA_EXFILTRATION]: The skill accesses a sensitive local environment file at a hardcoded Windows path (C:/code_proj/gitlab-proj/agent-eval/.env) to read AGENT_TEAMS_TOKEN and AGENT_TEAMS_TOKEN_PROD for API authentication.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface by processing external data from session messages.
Ingestion points: Fetches session titles and full message content through the TeamsClient from cloud API endpoints (/api/chat/sessions, /api/chat/sessions/{id}/messages).
Boundary markers: No explicit markers or warnings are used when rendering or exporting session content.
Capability inventory: Includes file system operations (write_text, mkdir), process execution (subprocess.run), and module execution (importlib.util).
Sanitization: The skill does not sanitize or escape the content fetched from the API before displaying it or writing it to local files.

dp-session-forensics-cloud