The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources, creating a surface for indirect prompt injection attacks.
Ingestion points: The skill reads data from SharePoint lists (Get_SP_Items), Outlook emails (Get_Email_Template), HTTP request bodies (manual triggers), and SharePoint file content (GetFileContent).
Boundary markers: The provided templates do not explicitly enforce delimiters or use explicit safety instructions when interpolating these external inputs into flow actions.
Capability inventory: The skill possesses extensive capabilities including file writes (UpdateFile, PatchItem), network operations (HttpRequest), sending emails (SendEmailV2), posting to Teams (PostMessageToConversation), and triggering other flows (trigger_live_flow, resubmit_live_flow_run).
Sanitization: Sanitization is limited to standard data transformation functions such as coalesce and json(), which do not provide protection against natural language instruction injection.
[COMMAND_EXECUTION]: The Python helper script in SKILL.md executes HTTP requests to https://mcp.flowstudio.app/mcp using urllib.request to perform MCP tool calls. This allows the agent to execute actions on the remote FlowStudio server.
[DATA_EXFILTRATION]: The skill transmits flow definitions, connection references, and environment IDs to the FlowStudio MCP server endpoint. While consistent with its stated purpose of remote flow deployment, this involves the transfer of environment metadata and potentially sensitive workflow logic to a third-party service.
[DYNAMIC_EXECUTION]: The instructions utilize dynamic techniques such as __import__('datetime') within the Python helper logic and a pattern for building JSON dictionaries at runtime via json(concat(...)) in references/action-patterns-data.md to simulate a dictionary type.

power-automate-build