The Agent Skills Directory

Secure Scaffolding and File Operations: The skill uses a custom noLinkedAncestors utility throughout its scripts to prevent directory traversal and symlink-based attacks when creating or reading application files.
Network Isolation in Test Harness: The browser testing harness (browser-harness.mjs) includes functionality to explicitly block external network traffic (HTTP, HTTPS, WebSocket) during local-only checks, ensuring that synthetic demo data remains isolated to the local environment.
Integrity-Focused Dependency Management: Scaffolding and setup scripts (setup.mjs, create-app.mjs) enforce the use of the --ignore-scripts flag during npm installations and perform read-back verification on generated JSON manifests to ensure environment consistency.
Vendor-Aligned Infrastructure: The skill is designed for use within the Microsoft Power Apps ecosystem. All external references, such as the Power Apps Local Play URL (apps.powerapps.com) and peer dependencies like @microsoft/power-apps, are official vendor resources.
Synthetic Data and Local-First Persistence: The skill uses browser-local storage for synthetic demo data and explicitly warns against using it for production secrets or authenticated storage, adhering to a least-privilege model for demo environments.
Verified Host Handoff: The host verification mechanism uses scoped, single-use challenges and cryptographic hashes to bind verification evidence to specific application states, preventing the reuse of stale or unauthorized host observations.

powercat-codeappscompact