The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute the copilot CLI tool and various shell utilities (e.g., sed, printf, test) to facilitate code reviews and Q&A. These instructions emphasize security best practices, such as using quoted variables and avoiding dangerous flags like --yolo or --allow-all-tools without specific authorization.
[PROMPT_INJECTION]: The skill implements a workflow where local file contents are read and included in prompts sent to the external Copilot CLI. This creates a surface for indirect prompt injection, where malicious instructions hidden in a project's source code could attempt to influence the agent's behavior or the CLI output.
Ingestion points: Local files are ingested using shell commands (e.g., sed -n '1,220p') as shown in the code review examples in SKILL.md.
Boundary markers: The skill suggests prefixing the untrusted content with static instructions (e.g., 'Review this approved excerpt...'), but does not define strict delimiters or sanitization for the embedded content.
Capability inventory: The agent has the capability to execute shell commands (copilot) and read local files.
Sanitization: The skill explicitly warns against interpolating untrusted text directly into shell source strings and recommends using subshells and quoted variables to maintain safety.

ask-copilot