create-code-app

Pass

Audited by Gen Agent Trust Hub on Nov 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Scaffolding from Remote Sources: The skill employs npx degit to fetch project templates from a public repository under the microsoft organization on GitHub. This is a common and efficient method for initializing projects with standard boilerplate code from the platform vendor.
  • Official Tooling Integration: It installs the @microsoft/power-apps-cli package as a local development dependency. This ensures that the official Power Platform CLI is available for initialization and deployment tasks within the project environment.
  • Structured Deployment Workflow: The skill guides users through a multi-step process that includes prerequisite checks, environment selection, and a baseline deployment to verify the setup. Final deployments require explicit user confirmation, providing a checkpoint for administrative oversight.
  • Requirement Gathering: The workflow includes an interactive phase where the agent gathers application requirements from the user. While this involves processing external input to plan the application architecture, the skill uses a step-by-step planning and approval model to maintain transparency.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 9, 2026, 08:40 AM