configure-canvas-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [Data Ingestion Surface]: The skill requests a Power Apps studio URL from the user to extract session parameters (
environment_id,app_id,environment_category). - Ingestion Point: The user input URL is requested in
SKILL.mdstep 1. - Boundary Markers: No specific structural boundaries are defined for the text extraction, though explicit formatting expectations for the URL are provided to the user.
- Capability Inventory: Uses the
mcp__canvas-authoring__connecttool and theBashtool. - Sanitization: The skill relies on string and path segment parsing to isolate IDs before passing them to the connection tool.
- [Local Command Execution]: The skill employs a local command line instruction (
dotnet --list-sdks) via the Bash tool to verify whether the required .NET environment is available if the MCP server fails to launch. This is a routine diagnostic check to assist the user with troubleshooting.
Audit Metadata