The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill automatically scans, parses, and processes user-supplied workspace files (.bicep, .bicepparam, azure.yaml, parameters.json) to perform deployment validations. If an adversary introduces malicious inputs within these files (e.g., via a public repository or an untrusted pull request), they could attempt to influence the agent's context or downstream logic.
Ingestion points: Workspace files including .bicep, .bicepparam, azure.yaml, and JSON parameter files as described in SKILL.md (Step 1).
Boundary markers: Absent; there are no instructions to encapsulate the contents of these files with explicit boundary delimiters or defensive system instructions.
Capability inventory: Spawns system processes via bicep build, azd provision, and az deployment commands, and performs local file creation (preflight-report.md).
Sanitization: Absent; the skill does not mandate sanitizing, escaping, or strict schema validation on the contents of the discovered parameter/bicep files before passing them to the validation tools or reporting them.
[COMMAND_EXECUTION]: The skill requires executing shell commands using local command-line utilities (az, azd, and bicep). This behavior is aligned with its primary purpose of validating Azure templates, but it inherently interacts with dynamically determined filenames and parameters, which can pose risks if paths are malformed or manipulated.

azure-deployment-preflight