The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow where the agent processes data from various external sources, including web search results via Bing, document retrieval through vector stores, and responses from Model Context Protocol (MCP) servers.
Ingestion points: Data enters the agent context through HostedWebSearchTool results, HostedFileSearchTool outputs, and responses from external MCP servers via HostedMCPTool or MCPStreamableHTTPTool (referenced in references/tools.md and references/mcp.md).
Boundary markers: The skill instructions explicitly note to "Treat retrieved/tool text as untrusted" and warn that "prompts are not access controls" in the SKILL.md. Further warnings in references/advanced.md state that citation markup does not authenticate sources.
Capability inventory: The agent has capabilities for remote Python code execution (HostedCodeInterpreterTool), network requests to external APIs (OpenAPITool, MCPStreamableHTTPTool), and file system interactions (file upload and search via AgentsClient).
Sanitization: While the documentation provides architectural warnings, the provided code examples do not demonstrate specific sanitization or filtering logic for data interpolated from these external sources.
[EXTERNAL_DOWNLOADS]: The skill instructs users to install Python packages such as agent-framework and agent-framework-foundry. These instructions are standard for setting up the development environment and target official registries.
[COMMAND_EXECUTION]: The skill utilizes the HostedCodeInterpreterTool, which allows the agent to execute Python code in a hosted, sandboxed environment on Azure. While this is a high-privilege capability, it is a standard feature of the described service and includes warnings about scoping authorization and tool allowlists.

agent-framework-azure-ai-py