The Agent Skills Directory

Indirect Prompt Injection Surface: The skill processes data retrieved from external Power Automate or Flow environments, such as flow names, environment lists, and run histories. This creates a potential surface where malicious instructions embedded in that data could influence the agent's behavior.
Ingestion points: Data enters the agent's context through tools like mcp__flowagent__list_flows, mcp__flowagent__get_run_history, and mcp__flowagent__list_environments (documented in SKILL.md).
Boundary markers: The instructions do not explicitly require the use of delimiters or specific warnings to ignore instructions that might be embedded in the flow metadata or error logs.
Capability inventory: The skill possesses high-impact capabilities, including delete_flow, cancel_all_runs, resubmit_run, and Bash access, which could be misused if the agent obeys instructions found within the processed data.
Sanitization: There are no specific instructions for validating or escaping external content (like flow names or error messages) before the agent evaluates them to decide on subsequent actions.
Account Management Capabilities: The skill includes tools for identity and account management, such as mcp__flowagent__list_accounts and mcp__flowagent__switch_account. These are used to facilitate multi-account management within the Flow ecosystem. Users should be aware that the skill can transition between different authenticated contexts.

manage-flows