add-pen-input
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFE
Full Analysis
- [Internal Library Integration]: The skill uses the
@microsoft/power-apps-native-pen-inputpackage, which is a resource provided by the skill's author. The implementation is handled locally within the application's source code. - [Safe Dependency Management]: The skill includes explicit checks to ensure the required package is already present in the environment before proceeding. It avoids running installation commands like
npm installornpx expo install, reducing the risk of unauthorized external downloads or environment modifications. - [Data Handling and Validation]: Signature data is handled as standard PNG data URIs. The skill provides clear patterns for sanitizing these URIs (stripping prefixes) before storage and utilizes generated service layers rather than direct API calls, which is a recommended practice for maintaining data integrity.
- [Least Privilege Environment]: The skill is configured with
user-invocable: falseanddisable-model-invocation: true, ensuring it only runs as a controlled internal helper within specific developer-initiated workflows.
Audit Metadata