app-builder
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill executes local
nodescripts and official Power Platform CLI (pac) commands to automate environment setup, metadata retrieval, and application deployment. These operations are core to the skill's utility and are used to interact with the vendor's application ecosystem. - Dynamic Code Generation: The skill dynamically generates
.tsx(TypeScript React) source code for application pages based on user-provided requirements. This process is managed through a specialized subagent and a defined 'generate-pages' phase to ensure the generated code aligns with the application specification. - Indirect Prompt Injection Surface: The skill ingests natural language input to define application components such as tables, columns, and logic. While this represents a surface for indirect prompt injection, the skill implements a structured authoring flow where input is converted into a JSON specification and subjected to a mandatory linting check ('Guardrail lint') before execution.
- Environment Interaction: To ensure successful deployment, the skill retrieves environment details and authentication status via established command-line utilities. This interaction is necessary for the skill to perform its stated tasks within the user's authorized development environment and follows standard administrative patterns.
Audit Metadata