The Agent Skills Directory

[PROMPT_INJECTION]: The main instructions in SKILL.md use phrases like "IGNORE any prior training" and "supersedes all other sources." These are common markers for system prompt overrides, intended to force the agent to prioritize the provided workflow over its base training and safety protocols.
[INDIRECT_PROMPT_INJECTION]: The skill performs automated scans of user-controlled workspace files—such as package.json, requirements.txt, and technology-specific configuration files (described in references/scan.md and references/analyze.md). These project files serve as ingestion points where malicious instructions could be embedded by an attacker to influence the agent's behavior during architecture planning or command generation.
Ingestion points: references/scan.md and references/analyze.md document the scanning of project files (e.g., package.json, requirements.txt, *.csproj, azure.yaml).
Boundary markers: The skill does not define specific delimiters or warnings to ignore instructions that might be embedded within the project files it parses.
Capability inventory: The skill produces and executes powerful artifacts including Azure CLI commands (az, azd), infrastructure-as-code files (Bicep, Terraform), and Dockerfiles.
Sanitization: There is no evidence of sanitization or validation logic applied to the content read from external project files before it is used to drive the agent's logic.
[DYNAMIC_EXECUTION]: The documentation for Azure Static Web Apps (references/services/static-web-apps.md) and AZD configuration (references/recipes/azd/azure-yaml.md) includes templates for package.json build scripts. These templates utilize node -e to execute inline JavaScript that performs recursive filesystem operations, such as directory creation and file copying, which constitutes dynamic code execution at build time.

azure-prepare