add-mcscopilot

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [Command Execution]: The skill utilizes the Bash tool to execute standard project commands, such as pa app add data-source for connector registration and npm run build for compiling the application. These are routine operations within the Power Apps development lifecycle.
  • [External Service Interaction]: The instructions direct the agent to interact with official Microsoft domains (e.g., make.powerapps.com, api.powerplatform.com) for environment configuration and agent identification. These are well-known, trusted service endpoints relevant to the skill's purpose.
  • [Data Processing Considerations]: The skill provides code patterns for parsing JSON responses from external Copilot Studio agents. While this is the intended functionality, it introduces an indirect prompt injection surface where the content returned by an external agent could influence subsequent application logic. The skill uses standard parsing techniques and includes placeholders for required API parameters like notificationUrl.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 10:15 AM
Security Audit — agent-trust-hub — add-mcscopilot