add-excel
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Command Execution]: The skill utilizes the
Bashtool to executepa app add data-sourceandnpm run build. These represent standard development operations within the Power Apps CLI environment and are used to configure data sources and compile the project. - [Indirect Prompt Injection Surface]: In Step 2, the skill prompts for user-supplied data such as workbook paths and table names. This data is interpolated into shell commands and source code. While this is necessary for the skill's functionality, it is a common pattern for processing untrusted data that warrants standard boundary-marker precautions.
- [Resource Management]: The skill references 'connection-id' values and environment IDs. Within the context of Power Apps development, these are resource identifiers rather than sensitive credentials, and the skill correctly directs the user to the official Power Apps portal for creation and management.
Audit Metadata