create-code-app
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Scaffolding from Remote Sources: The skill employs
npx degitto fetch project templates from a public repository under themicrosoftorganization on GitHub. This is a common and efficient method for initializing projects with standard boilerplate code from the platform vendor. - Official Tooling Integration: It installs the
@microsoft/power-apps-clipackage as a local development dependency. This ensures that the official Power Platform CLI is available for initialization and deployment tasks within the project environment. - Structured Deployment Workflow: The skill guides users through a multi-step process that includes prerequisite checks, environment selection, and a baseline deployment to verify the setup. Final deployments require explicit user confirmation, providing a checkpoint for administrative oversight.
- Requirement Gathering: The workflow includes an interactive phase where the agent gathers application requirements from the user. While this involves processing external input to plan the application architecture, the skill uses a step-by-step planning and approval model to maintain transparency.
Audit Metadata