add-azuredevops
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill performs standard development operations using the command line, such as adding data sources via
pa app add data-sourceand building the project withnpm run build. These actions are consistent with the intended use case of setting up a Power Apps project. - Indirect Prompt Injection Surface: The skill includes instructions to read and modify specific project files to correct parameter naming. While this involves processing local file content, it is a core part of its functionality to correct known issues in generated code.
- Ingestion points: Reads from
src/generated/services/AzureDevOpsService.ts,.power/appschemas/dataSourceInfo.ts, and.power/schemas/visualstudioteamservices/visualstudioteamservices.Schema.json. - Boundary markers: The skill uses specific code patterns for targeted replacement but does not employ explicit delimiters for untrusted data.
- Capability inventory: Uses
Read,Edit,Write, andBashto modify files and run build scripts. - Sanitization: The skill renames specific internal parameters (
parameterstobody) without external validation logic. - Use of Trusted Services: The skill references official Microsoft and Azure DevOps domains for API communication and documentation, ensuring that network activity is directed toward established vendor infrastructure.
Audit Metadata