The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data (such as bug titles and repro steps from CI failures) and interpolates them into WIQL queries and API requests to Azure DevOps.
Ingestion points: title, description_html, and text_html parameters in functions within SKILL.md and references/azure-devops-wit-reference.md.
Boundary markers: None present in the code snippets; data is interpolated directly using f-strings.
Capability inventory: Network operations via requests (POST, PATCH, GET) and command execution via az boards CLI to the Azure DevOps environment.
Sanitization: The documentation explicitly advises stripping reserved characters ([, ], ') in the 'Anti-patterns' section, although the illustrative code snippets do not implement this sanitization.
[EXTERNAL_DOWNLOADS]: The documentation references the installation of the azure-devops extension for the Azure CLI using az extension add. This is a well-known extension for a trusted service.
[CREDENTIALS_UNSAFE]: The skill correctly handles authentication by demonstrating the use of Personal Access Tokens (PATs) retrieved from environment variables (os.environ["ADO_PAT"]) rather than hardcoding secrets.

azuredevops-bug-workflow