The Agent Skills Directory

[Indirect Prompt Injection] (MEDIUM): The skill is susceptible to indirect prompt injection due to its core functionality of receiving and processing external data from message brokers.
Ingestion points: The receive_messages function in SKILL.md allows the agent to ingest arbitrary message content from Azure Service Bus queues and topics.
Boundary markers: Absent. The examples process raw message strings without any delimiters or instructions to treat the data as untrusted.
Capability inventory: The skill implements sender.send_messages() (network operation to forward/respond) and print() (local display) capabilities.
Sanitization: Absent. No sanitization, validation, or filtering of received message content is demonstrated in the code examples.
[Unverifiable Dependencies] (LOW): The skill installs external Python packages required for its operation.
Evidence: pip install azure-servicebus azure-identity in SKILL.md.
Trusted Source: These packages are official SDKs from the azure organization (Microsoft), which is a trusted source, resulting in a downgraded severity per [TRUST-SCOPE-RULE].

azure-servicebus-py