The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests untrusted data from external sources and possesses significant operational capabilities.
Ingestion points: Flow run action outputs and flow definitions are fetched from external systems via get_live_flow_run_action_outputs and get_live_flow (referenced in SKILL.md and references/debug-workflow.md).
Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present when processing the external flow data.
Capability inventory: The skill includes tools to modify flow logic (update_live_flow) and execute flows (trigger_live_flow, resubmit_live_flow_run), which could be abused if malicious instructions are embedded in retrieved flow outputs.
Sanitization: No sanitization or validation logic is defined for the content retrieved from the flow runs in any of the provided files.
[DATA_EXFILTRATION]: The skill transmits Power Automate flow details, including potentially sensitive action inputs and outputs, to the external service at https://mcp.flowstudio.app. This behavior is transparently documented as the primary mechanism for the skill's debugging functionality but involves processing enterprise data through a third-party API.
[COMMAND_EXECUTION]: Provides Python helper functions using the urllib.request library to execute calls to the FlowStudio MCP server, enabling the agent to perform operations based on parameters provided during the debugging workflow.

power-automate-debug