The Agent Skills Directory

[Dynamic Code Execution]: The file run.py utilizes Python's importlib.util to dynamically load and execute logic from a script located at a computed relative path (../access-to-dataverse/run.py). While this is used for code reuse between migration workflows, dynamic loading from computed paths is a security consideration that should be reviewed to ensure the target script is trusted.
[Indirect Prompt Injection Surface]: The skill is designed to ingest and process user-provided external data from Microsoft Access databases (.mdb, .accdb) and CSV files. These ingestion points represent a surface where untrusted data enters the agent's context. Although the skill includes instructions for manual review of sensitive data (PII/payment info) and requires user confirmation before execution, the lack of explicit boundary markers for data interpolation is a potential consideration.
[Command Execution]: The skill relies on the Power Platform CLI (pac) and standard shell tools to perform authentication and provisioning tasks in Dataverse. These commands are part of the intended vendor functionality but involve managing environment access and executing scripts based on configuration files like mapping.yaml.

powercat-accessmigration