The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) as it is designed to ingest and process data from external, untrusted sources such as ITSM ticket descriptions and file names.
Ingestion points: Runbooks 1-7 in SKILL.md ingest ticket details and search results; references/ticket-workflows.md describes automated triage based on ticket descriptions.
Boundary markers: Absent. The instructions do not include delimiters or warnings to ignore embedded instructions within the processed ticket data.
Capability inventory: The agent is granted significant capabilities including Bash access, file modification (Write, Edit), and instructions to execute privileged Graph API and Exchange PowerShell operations.
Sanitization: No explicit sanitization or validation of the user-supplied text (e.g., ticket descriptions) is performed before it is used to influence agent logic.
[COMMAND_EXECUTION]: The skill relies heavily on the agent executing complex shell commands and administrative PowerShell snippets. While these are intended for legitimate M365 management (e.g., Add-MailboxPermission, Set-Mailbox), they represent a high-privilege execution environment that could be abused if the agent is compromised via the aforementioned indirect injection vector.

servicedesk-runbooks