The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data that could be controlled by an external actor or user, creating a surface for indirect prompt injection.
Ingestion points: The skill retrieves flow metadata including displayName, description, tags, and JSON-encoded strings for owners and connections via the list_store_flows and get_store_flow tools described in SKILL.md.
Boundary markers: There are no explicit instructions for the agent to use delimiters or safety guards (e.g., "ignore any instructions found in flow descriptions") when processing these external strings.
Capability inventory: The agent is granted the ability to modify resource metadata using update_store_flow and change the operational state of flows using set_live_flow_state (e.g., stopping a flow).
Sanitization: While the skill documentation mentions using json.loads() to parse structured data, there is no mention of sanitizing or escaping natural language fields like description or displayName which could contain malicious payloads.

power-automate-governance