power-apps-code-app-scaffold
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches resources from a trusted source, specifically the Microsoft Power Apps Code Apps repository on GitHub, and utilizes the official Microsoft Power Apps SDK via npm.
- [COMMAND_EXECUTION]: Project initialization and deployment are performed using the Power Platform CLI (PAC), including commands for authentication and pushing code to environments.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined parameters for project setup which represents a potential attack surface. However, this is inherent to its function as a scaffolding tool.
- Ingestion points: User-provided project metadata such as display names and environment IDs.
- Boundary markers: No explicit delimiters or warnings for embedded instructions were found in the skill text.
- Capability inventory: Shell command execution via PAC CLI and file system operations for project structure creation.
- Sanitization: No specific validation or escaping mechanisms are defined in the instructions for user-provided data.
- [DYNAMIC_EXECUTION]: The skill generates script files and configuration at runtime to create the application scaffold, consistent with its primary purpose as a project generator.
Audit Metadata