add-pen-input

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFE
Full Analysis
  • [Native Module Integration]: The skill interacts with the @microsoft/power-apps-native-pen-input package, which is a vendor-internal module. It correctly verifies the presence of this package in package.json before attempting to create wrappers, ensuring it doesn't attempt to install untrusted dependencies or perform unauthorized native configuration changes.
  • [Secure Error Handling]: The implementation of src/native/penInput.ts includes robust error handling using a discriminated union pattern. It explicitly handles user cancellations as non-error paths and accounts for missing native modules, which prevents application crashes and provides a predictable API surface for developers.
  • [Data URI Handling]: The skill provides a utility to strip prefixes from base64 data URIs. This is a standard data transformation for preparing image data for backend storage (like Dataverse) and does not involve any unsafe data processing or exfiltration patterns.
  • [Least Privilege]: The skill uses allowed-tools like Read, Write, and Bash to perform its intended task of file verification and creation. The shell commands used (test -f, node -e) are scoped to environment verification and package checking, which are appropriate for its function as a development helper.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 03:31 AM
Security Audit — agent-trust-hub — add-pen-input