The Agent Skills Directory

Automated Execution of Generated Code: In its final validation phase, the skill instructs the agent to create a virtual environment, install dependencies, and execute a generated test script (test_<name>.py). As this code is constructed from the logic and source files of the original Prompt Flow (including .py and .dag.yaml files provided by the user), this presents a potential security consideration if the source content contains unintended or malicious commands.
Indirect Prompt Injection Surface: The skill is designed to ingest untrusted data, such as Prompt Flow YAML definitions and Jinja2 templates, and specifically instructs the agent to preserve all prompt text verbatim. Without sanitization or boundary markers, any existing injections or malicious logic in the source files will be transitioned into the new workflow environment.
Local File and Directory Access: The conversion process involves significant file system operations, including copying entire user-defined Python packages and data resources (e.g., .jsonl, .csv files) into a new project directory to ensure the output is self-contained.
Dynamic Dependency Installation: The skill generates a requirements.txt file and automates the installation of packages during its verification phase. While the packages listed (such as agent-framework and azure-identity) are standard Microsoft-authored tools, the automated execution of package managers on generated files is a pattern that should be monitored.

promptflow-to-maf