add-cloud-flow
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External API Interaction: The skill communicates with the Microsoft Power Automate Flow RP API to retrieve a list of available flows. This interaction uses the user's existing authentication context from the PAC CLI and Azure CLI to access environment-specific resources.
- Frontend Code Generation: The skill generates TypeScript or JavaScript service functions to allow the site's frontend to trigger cloud flows. This includes implementing mandatory security headers, such as CSRF tokens, to ensure secure communication with the Power Pages endpoint.
- Data Ingestion for Review Plans: The skill ingests flow metadata, such as display names and descriptions, from external API responses to generate an HTML-based implementation plan. The generation process includes basic sanitization to handle characters in the metadata correctly within the HTML preview.
- User Approval Checkpoints: The workflow incorporates several manual checkpoints, or 'gates,' requiring user confirmation before significant actions are taken, such as writing metadata files, creating web roles, or deploying the site.
- Local Script Execution: The skill executes several utility scripts provided within its own package to perform environment checks, list flows, and validate generated YAML metadata, ensuring the resulting configuration meets project standards.
Audit Metadata