The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to ingest and analyze external, untrusted data from Power Automate flow runs and use that analysis to modify flow logic.
Ingestion points: The skill reads dynamic data from flow runs via get_live_flow_run_action_outputs and get_live_flow_run_error in SKILL.md.
Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands within the ingested flow outputs.
Capability inventory: The skill possesses high-impact capabilities including update_live_flow (modifying logic), trigger_live_flow (executing logic), and resubmit_live_flow_run (replaying execution).
Sanitization: No sanitization or validation of the ingested flow data is performed before it influences the agent's decision to update flow definitions.
[COMMAND_EXECUTION]: The skill enables the agent to autonomously modify executable logic in a cloud environment. The update_live_flow tool allows the agent to change flow definitions, which could lead to unauthorized or unintended changes to production workflows if the agent is manipulated.
[DATA_EXFILTRATION]: The skill provides the ability to read the full inputs and outputs of Power Automate actions through get_live_flow_run_action_outputs. These payloads frequently contain sensitive data such as PII, internal business data, or temporary credentials. While the skill includes a warning about not including secrets in 'Compose bookends', the core tools inherently expose sensitive runtime data to the agent and the third-party MCP server at mcp.flowstudio.app.

flowstudio-power-automate-debug