add-azuredevops

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill performs standard development operations using the command line, such as adding data sources via pa app add data-source and building the project with npm run build. These actions are consistent with the intended use case of setting up a Power Apps project.
  • Indirect Prompt Injection Surface: The skill includes instructions to read and modify specific project files to correct parameter naming. While this involves processing local file content, it is a core part of its functionality to correct known issues in generated code.
  • Ingestion points: Reads from src/generated/services/AzureDevOpsService.ts, .power/appschemas/dataSourceInfo.ts, and .power/schemas/visualstudioteamservices/visualstudioteamservices.Schema.json.
  • Boundary markers: The skill uses specific code patterns for targeted replacement but does not employ explicit delimiters for untrusted data.
  • Capability inventory: Uses Read, Edit, Write, and Bash to modify files and run build scripts.
  • Sanitization: The skill renames specific internal parameters (parameters to body) without external validation logic.
  • Use of Trusted Services: The skill references official Microsoft and Azure DevOps domains for API communication and documentation, ensuring that network activity is directed toward established vendor infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 10:15 AM
Security Audit — agent-trust-hub — add-azuredevops