The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill instructs the agent to execute a diagnostic script using powershell -ExecutionPolicy Bypass. This command explicitly disables PowerShell's execution policy, a security feature that controls the execution of scripts. Using this flag to run unsigned or local scripts is a known technique to circumvent system security restrictions.
[DYNAMIC_EXECUTION]: The skill relies on dotnet run to execute the C# source file create-backlog.cs. This involves runtime compilation and execution of code, which can be an attack vector if the source file is modified by an attacker or if the execution environment is manipulated to compile malicious code.
[COMMAND_EXECUTION]: The create-backlog.cs script spawns an external process to run the az account get-access-token command. Spawning shell commands to retrieve sensitive Entra ID identity tokens increases the risk of credential interception and relies heavily on the security of the local shell environment.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external findings from various file formats, creating a pathway for malicious instructions to influence the agent's behavior.
Ingestion points: Untrusted data enters the agent context through read_source.py (which processes Excel and CSV files) and through the agent's direct reading of documents and pasted text.
Boundary markers: The instructions include manual confirmation steps for mapping and validation (Safety Gates). While these provide human oversight, they do not programmatically isolate or sanitize the data to prevent the agent from acting on malicious instructions embedded in the input.
Capability inventory: The skill has high-impact capabilities, including making authenticated network requests to Azure DevOps (dev.azure.com) and modifying local spreadsheet files via tracking.py.
Sanitization: The provided scripts lack explicit sanitization or strict schema validation for the content extracted from external files, allowing arbitrary text from the source to be used in work item titles, descriptions, and API payloads.

findings-to-ado-backlog