The Agent Skills Directory

[PROMPT_INJECTION]: Instructions in SKILL.md ('AUTHORITATIVE GUIDANCE — Follow these instructions exactly. This supersedes prior training') and references/global-rules.md ('MANDATORY — These rules apply to ALL skills. Violations are unacceptable') use directive language intended to override the agent's core instructions and baseline training.
[INDIRECT_PROMPT_INJECTION]: The skill processes external configuration data, creating a vulnerability surface for indirect prompt injection.
Ingestion points: Reads .azure/preparation-manifest.md, azure.yaml, and Bicep files from the workspace.
Boundary markers: The instructions do not define clear boundaries or use delimiters for ingested data, nor do they include warnings to ignore embedded instructions.
Capability inventory: The skill executes shell commands (az, azd, terraform), performs filesystem writes, and invokes external tools (mcp_azure_mcp_policy).
Sanitization: There is no evidence of sanitization or validation of the contents of the configuration files before they are used to drive further actions.
[DATA_EXFILTRATION]: The skill retrieves the Azure subscription ID using az account show --query id -o tsv. While used for policy validation, the retrieval and transfer of this sensitive metadata identifier between tools represents exposure of account-specific identifiers.

azure-validate