The Agent Skills Directory

Command Execution: The skill utilizes local Node.js scripts and the Microsoft Power Platform CLI (pac) to orchestrate the application building process. These tools perform environment discovery and deployment tasks within the user's authenticated session, representing standard behavior for a development-focused tool.
Indirect Prompt Injection Considerations: As the skill processes natural language input and reads data from the Power Platform environment to generate app specifications, it possesses an attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the context via user arguments, environment metadata (tables/apps), and downloaded app specifications (via download-model-app.js).
Boundary markers: The skill employs EnterPlanMode and ExitPlanMode to delimit the planning phase and requires the agent to present a dry-run plan for user approval.
Capability inventory: The skill has the capability to write files (specifications and code), execute shell commands via internal scripts, and dispatch subagents for specific tasks.
Sanitization: Security is reinforced through a 'guardrail lint' (lint-app-spec.js) and structural validation tools that verify the integrity of the App Spec before any infrastructure changes are applied.
Dynamic Code Generation: The skill dispatches worker agents to generate React/Griffel code (.tsx) for generative pages. This generated code is subjected to automated style and iteration checks (check-griffel-styles.js) to prevent runtime issues and ensure compliance with platform standards.
Environment Scoping: All operations are strictly targeted at the user's authorized Power Platform environment, with tools provided to inspect existing solutions and prevent unintended modification of pre-existing data structures.

app-builder