The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install several .NET packages from the NuGet registry.
Evidence: dotnet add package Microsoft.Agents.Hosting.AspNetCore, Microsoft.Agents.Authentication.Msal, Microsoft.Agents.Storage, Microsoft.Agents.CopilotStudio.Client, and Microsoft.Identity.Client.Extensions.Msal.
Context: These packages originate from a well-known service (Microsoft) and are standard dependencies for the SDK usage described in the skill.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates a pattern for building an agent that ingests and processes untrusted data from external messaging platforms like Teams and Microsoft 365.
Ingestion points: Untrusted activity text is ingested via the IAgentHttpAdapter and accessed through the turnContext.Activity.Text property in SKILL.md.
Boundary markers: The provided code examples do not include explicit delimiters, boundary markers, or system instructions to separate untrusted user input from the agent's logic or downstream prompts.
Capability inventory: The agent implementation includes capabilities to send activities to users (turnContext.SendActivityAsync) and use MSAL-based authentication to interact with Microsoft 365 services.
Sanitization: The MyAgent implementation in SKILL.md echoes user input directly without demonstrating validation or sanitization of the incoming message content.

m365-agents-dotnet