The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted infrastructure-as-code files (Terraform, Bicep, ARM templates) which could contain malicious content designed to influence the agent's behavior.
Ingestion points: The skill uses the Glob and Read tools in SKILL.md to discover and inspect external files across the repository.
Boundary markers: SKILL.md includes a 'Prompt Injection Safety Notice' that explicitly instructs the agent to treat configuration values and comments as data rather than instructions.
Capability inventory: The skill is limited to Read, Grep, and Glob tools; it does not have access to network tools, file writing capabilities, or shell execution.
Sanitization: The skill lacks automated sanitization or schema validation for ingested files, relying instead on instructional guardrails provided in the markdown.

azure-review