The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses the $ARGUMENTS variable to interpolate user-provided targets directly into its operating instructions within SKILL.md. If this input contains malicious directives, it could potentially override the agent's intended behavior.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted external data from infrastructure-as-code files (Terraform, Bicep, ARM templates).
Ingestion points: Discovery phase in SKILL.md uses Glob to locate and Read various Azure configuration files.
Boundary markers: The skill contains a specific 'Prompt Injection Safety Notice' in SKILL.md that instructs the agent to treat values as data, not instructions.
Capability inventory: The skill uses Read, Grep, and Glob tools, providing it with file system access to the repository.
Sanitization: The skill includes explicit instructions to disregard directives embedded in configuration files, such as 'skip this check' or 'mark as compliant'.

azure-review