powercat-skills-router
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Resource References: The skill references two official GitHub repositories (github.com/microsoft/power-cat-skills and github.com/microsoft/power-platform-skills) to discover and load specialist capabilities. These are vendor-owned resources used for the skill's primary routing function.
- Indirect Prompt Injection Surface: The skill is designed to ingest and process external metadata from marketplace catalogs and package manifests. It includes specific defensive instructions to mitigate potential injection risks, such as treating repository text as untrusted data, rejecting path traversal, and avoiding the execution of embedded commands during the discovery phase.
- Ingestion points: Discovery of
marketplace.jsonand.claude-plugin/marketplace.jsonfrom the specified GitHub repositories. - Boundary markers: Explicit instructions to treat repository content as untrusted and to maintain independent revisions for all source data.
- Capability inventory: The skill utilizes host-provided interfaces for skill discovery, repository reading, plugin management, and skill loading/execution.
- Sanitization: Implements verification of package identities, checks for path traversal, and requires explicit user approval before any persistent changes are applied to the host environment.
- Plugin and Command Management: The routing workflow includes instructions for the agent to use host-supported interfaces for installing or updating skills. This process is governed by strict approval requirements, ensuring that no changes, such as enabling telemetry or external service hooks, occur without explicit user consent.
Audit Metadata