add-pdf-viewer

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [Secure Input Validation]: The skill implements a TypeScript wrapper that strictly validates URLs before passing them to native code. It explicitly rejects insecure protocols like http:// and untrusted formats like blob: or content://, mitigating risks associated with uncontrolled data input.
  • [Dependency Verification]: Instead of automatically installing packages, the skill uses a Node.js script to verify that the required native extension (@microsoft/power-apps-native-pdf-viewer) is already present in the project. This prevents unexpected supply chain changes and ensures the environment is correctly configured before proceeding.
  • [Controlled Command Execution]: The skill uses standard shell commands (test, node -e, npx tsc) for environment verification and type checking. These operations are scoped to the project directory and are used for validation purposes rather than administrative changes.
  • [Safe Native Integration]: The implementation avoids complex or risky PCF/HostingSDK paths, opting for a direct React Native API approach. It handles edge cases like missing native modules (NATIVE_MODULE_MISSING) gracefully rather than allowing the application to crash.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 10:29 AM
Security Audit — agent-trust-hub — add-pdf-viewer