create-code-app

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFE
Full Analysis
  • [External Template Scaffolding]: The skill uses npx degit to fetch application templates from a verified Microsoft repository. This ensures projects are started from a trusted baseline without including unnecessary git history.
  • [Power Platform CLI Integration]: All environment management and deployment tasks are handled by the official pac CLI, ensuring that authentication and data operations are conducted through secure, supported channels.
  • [Secure Shell Practices]: Commands executed via PowerShell utilize the -NoProfile argument, which prevents the loading of potentially malicious scripts from local user profiles and ensures consistent, predictable tool behavior.
  • [Input Handling Considerations]: The skill ingests user-provided text for application names and descriptions (Step 2) and interpolates them into CLI commands like pac code init (Step 6). While no explicit boundary markers are defined in the instructions, the use of official tooling for these operations follows standard development patterns.
  • [User-Centric Deployment]: A manual confirmation step is required before any code is pushed to a live environment, mitigating the risk of accidental or unauthorized updates.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 11:51 PM