The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted user-provided content (images and text descriptions) which it interprets to generate application structure and properties. This constitutes a structural attack surface common to generative AI development tools.
Ingestion points: Phase 2 (image loading from file paths or conversation) and Phase 3 (text-only mode descriptions) in SKILL.md ingest external data into the agent's context.
Boundary markers: Explicit delimiters or instructions to ignore embedded commands within user-provided descriptions are absent.
Capability inventory: The skill is configured with Write (to create YAML files), Bash (limited to pwd, mkdir, and rm for directory management and cleanup of internal temporary files), and Agent (orchestrating specialist sub-agents) tools.
Sanitization: The skill relies on structural constraints and a dedicated Assembly+QA agent (agents/assembly-agent.md) to validate output against a strict set of Power Apps schema rules and "Trap Tables," which acts as a secondary layer of sanitization for the generated code.
[SAFE]: No malicious patterns, obfuscation, or unauthorized access to sensitive system resources were detected. The use of shell commands is restricted to benign tasks essential for the skill's primary function of generating and managing temporary development artifacts.

canvas-apps-ui-gen