add-pdf-viewer
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [Secure Input Validation]: The skill implements a TypeScript wrapper that strictly validates URLs before passing them to native code. It explicitly rejects insecure protocols like
http://and untrusted formats likeblob:orcontent://, mitigating risks associated with uncontrolled data input. - [Dependency Verification]: Instead of automatically installing packages, the skill uses a Node.js script to verify that the required native extension (@microsoft/power-apps-native-pdf-viewer) is already present in the project. This prevents unexpected supply chain changes and ensures the environment is correctly configured before proceeding.
- [Controlled Command Execution]: The skill uses standard shell commands (
test,node -e,npx tsc) for environment verification and type checking. These operations are scoped to the project directory and are used for validation purposes rather than administrative changes. - [Safe Native Integration]: The implementation avoids complex or risky PCF/HostingSDK paths, opting for a direct React Native API approach. It handles edge cases like missing native modules (
NATIVE_MODULE_MISSING) gracefully rather than allowing the application to crash.
Audit Metadata