add-mcscopilot
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Command Execution]: The skill utilizes the Bash tool to execute standard project commands, such as
pa app add data-sourcefor connector registration andnpm run buildfor compiling the application. These are routine operations within the Power Apps development lifecycle. - [External Service Interaction]: The instructions direct the agent to interact with official Microsoft domains (e.g.,
make.powerapps.com,api.powerplatform.com) for environment configuration and agent identification. These are well-known, trusted service endpoints relevant to the skill's purpose. - [Data Processing Considerations]: The skill provides code patterns for parsing JSON responses from external Copilot Studio agents. While this is the intended functionality, it introduces an indirect prompt injection surface where the content returned by an external agent could influence subsequent application logic. The skill uses standard parsing techniques and includes placeholders for required API parameters like
notificationUrl.
Audit Metadata