ClawHub
Back to skill

Security audit

Power Platform Custom Connector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent guide for building and submitting Power Platform custom connectors, with some normal development and deployment risks users should manage carefully.

Install development tools in an isolated environment, pin versions where practical, avoid committing real secrets, review any generated script.csx before deployment, add regex timeouts/input limits if using the regex pattern, and verify connector permissions before running authenticated create or update commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:113
Finding

Unpinned third-party development tools create supply-chain execution risk

Content
View full analysis
Remediation
View remediation
` - `pip install paconn==` - `dotnet tool install --global Microsoft.PowerApps.CLI.Tool --version ` 2. Prefer local or isolated installations over global installations: - Use a dedicated Python virtual environment. - Use a project-local npm installation with a lockfile. - Use a .NET tool manifest instead of a global tool where practical. 3. Require package integrity controls: - Use lockfiles and package hashes where supported. - Verify package publisher identity and signatures. - Retrieve tools only from official registries and documented Microsoft sources. 4. Run installation and validation tools in a disposable, least-privilege environment without unrelated secrets. 5. Separate package installation from authenticated deployment. Review the resolved dependency set before exposing Power Platform credentials. 6. Document the tested versions in the Skill and establish a controlled process for reviewing upgrades. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/CUSTOM_CODE.md:213
Finding

User-controlled regular expressions can cause connector denial of service

Content
View full analysis
ExecuteAsync() { if (this.Context.OperationId == "RegexIsMatch") { var content = await this.Context.Request.Content .ReadAsStringAsync().ConfigureAwait(false); var input = JObject.Parse(content); var textToCheck = (string)input["textToCheck"]; var pattern = (string)input["regex"]; var rx = new Regex(pattern); var output = new JObject { ["textToCheck"] = textToCheck, ["isMatch"] = rx.IsMatch(textToCheck) }; var response = new HttpResponseMessage(HttpStatusCode.OK); response.Content = CreateJsonContent(output.ToString()); return response; } return new HttpResponseMessage(HttpStatusCode.BadRequest) { Content = CreateJsonContent($"Unknown operation: '{this.Context.OperationId}'") }; } } ``` ### Technical Analysis Both the regular expression pattern and the input text are read directly from the request. The pattern is compiled and evaluated using the .NET backtracking regular-expression engine without an explicit match timeout, pattern validation, or input-length restriction. An attacker can supply a pattern containing nested or overlapping quantifiers and a specially constructed input that forces catastrophic backtracking. Evaluation can then consume substantial CPU until the connector platform's execution timeout is reached. The project states that custom code has a two-minute execution limit, but that platform limit does not prevent resource exhaustion during the allowed interval. Because this is presented as a reusable custo ...[truncated 1294 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
ERTIFICATION.md) | [EXAMPLES.md](references/EXAMPLES.md) | [COMMON_MISTAKES.md](references/COMMON_MISTAKES.md)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

md
ERTIFICATION.md) | [EXAMPLES.md](references/EXAMPLES.md) | [COMMON_MISTAKES.md](references/COMMON_MISTAKES.md)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 982)May include surrounding context.

md
ERTIFICATION.md) | [EXAMPLES.md](references/EXAMPLES.md) | [COMMON_MISTAKES.md](references/COMMON_MISTAKES.md)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 1036)May include surrounding context.

md
ERTIFICATION.md) | [EXAMPLES.md](references/EXAMPLES.md) | [COMMON_MISTAKES.md](references/COMMON_MISTAKES.md)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 1049)May include surrounding context.

md
ERTIFICATION.md) | [EXAMPLES.md](references/EXAMPLES.md) | [COMMON_MISTAKES.md](references/COMMON_MISTAKES.md)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/OPENAPI_EXTENSIONS.md (reported line 32)May include surrounding context.

& Visibility Extensions

summary (standard OpenAPI)

Title for the action shown in the designer. Use sentence case.

json
"post": {
  "summary": "Send an email",
  "operationId": "SendEmail"
}

x-ms-summary

Display name for parameters and schema properties. Use Title Case.

json
{
  "name": "recipient",
  "in": "query",
  "type": "string",
  "x-ms-summary": "Recipient Email",
  "description": "The email address to send to"
}

For schema properties:

json
"properties": {
  "score": {
    "type": "number",
    "format": "float",
    "x-ms-summary": "Sentiment Score",
    "description": "A value between 0 and 1 indicating sentiment"
  }
}

x-ms-visibility

Controls how operations and parameters appear in the designer.

ValueBehavior
"important"Always shown first to the user
"advanced"Hidden under "Show advanced options" menu
"internal"Hidden from user. Must have a default value if also required

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown explicitly states that operation descriptions "Must be in English," which imposes a language requirement as a policy matter. The file does not present this as an opt-in choice for the user or justify it as a region-specific compliance constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The checklist requires that "All strings are in English," which is a natural-language locale constraint. Because the file does not frame this as a user choice or clearly justify it as an external program requirement at that point, it can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 894)May include surrounding context.

md
> ```

**Tips:**
- Process paths individually for APIs with many operations — large files may exceed context limits
- Always review and validate AI output against the coding standards before submission
- AI works best when the source API has comprehensive documentation

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The best-practices guidance says to ensure all text is in English, which is a blanket language restriction. This is a policy-relevant natural-language constraint and should either be optional for the user or explicitly justified by an external certification requirement.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/CERTIFICATION.md (reported line 189)May include surrounding context.

md
# The SAS URL must be valid for at least 15 days

# Using Azure CLI:
az storage blob upload `
  --account-name <storage-account> `
  --container-name <container> `
  --name package.zip `

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 780)May include surrounding context.

md
"redirectUrl": "https://global.consent.azure-apim.net/redirect/<<CONNECTOR_NAME>>",
      "customParameters": {
        "authorizationUrl": {
          "value": "https://api.example.com/oauth/authorize"
        },
        "tokenUrl": {
          "value": "https://api.example.com/oauth/token"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/CERTIFICATION.md (reported line 312)May include surrounding context.

md
"redirectUrl": "https://global.consent.azure-apim.net/redirect/<<CONNECTOR_NAME>>",
      "customParameters": {
        "authorizationUrl": {
          "value": "https://api.example.com/oauth/authorize"
        },
        "tokenUrl": {
          "value": "https://api.example.com/oauth/token"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/CERTIFICATION.md (reported line 315)May include surrounding context.

md
"redirectUrl": "https://global.consent.azure-apim.net/redirect/<<CONNECTOR_NAME>>",
      "customParameters": {
        "authorizationUrl": {
          "value": "https://api.example.com/oauth/authorize"
        },
        "tokenUrl": {
          "value": "https://api.example.com/oauth/token"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/CERTIFICATION.md (reported line 318)May include surrounding context.

md
"redirectUrl": "https://global.consent.azure-apim.net/redirect/<<CONNECTOR_NAME>>",
      "customParameters": {
        "authorizationUrl": {
          "value": "https://api.example.com/oauth/authorize"
        },
        "tokenUrl": {
          "value": "https://api.example.com/oauth/token"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/COMMON_MISTAKES.md (reported line 319)May include surrounding context.

md
"redirectUrl": "https://global.consent.azure-apim.net/redirect/<<CONNECTOR_NAME>>",
      "customParameters": {
        "authorizationUrl": {
          "value": "https://api.example.com/oauth/authorize"
        },
        "tokenUrl": {
          "value": "https://api.example.com/oauth/token"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file includes a setvaluefromurl example that fetches data from an external URL, and elsewhere demonstrates injecting a bearer token from connection parameters into request headers. Under the markdown-specific warning criterion, the document describes behaviors that can affect privacy or system integrity but does not warn users about outbound requests, trust boundaries, or handling of sensitive connection data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/COMMON_MISTAKES.md (reported line 186)May include surrounding context.

Example response from the API:

http
HTTP/1.1 201 Created
Location: https://api.myservice.com/webhooks/hook_abc123
Content-Type: application/json

{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/WEBHOOK_TRIGGERS.md (reported line 149)May include surrounding context.

Example response from the API:

http
HTTP/1.1 201 Created
Location: https://api.myservice.com/webhooks/hook_abc123
Content-Type: application/json

{

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown states "City names must be in English," which is a language/locale restriction expressed as a general limitation. The file does not offer a user language choice or explain a region-specific compliance reason for enforcing English input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.