create-mobile-app
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- Automated Command Execution: The skill extensively uses shell commands (Bash) to manage the project lifecycle, including environment detection, dependency verification, and running development servers. This includes the use of tools like
npx,expo, andaz, which are standard for the Power Apps and React Native development environments. - External Utility Downloads: Utilizes
npx --yes qrcodeto dynamically fetch and run a utility for generating QR codes used in the development server flow. This is a common practice for providing interactive features in developer tools without requiring manual installation of every utility. - Indirect Prompt Injection Surface: The skill takes user-provided app descriptions and requirements, which it then processes and passes to secondary agents (like the native-app-planner and screen-builder). The orchestration logic includes multiple 'gate' steps where the user reviews and approves the plan, which serves as a manual validation layer for the generated content.
- System-Level Interactions: The skill invokes operating system commands such as
open,xdg-open, or PowerShell'sStart-Processto launch browser-based plan previews or display generated images like QR codes. These interactions are triggered by specific project milestones and are designed to facilitate the user's local development experience. - Authentication and Environment Handling: Interacts with Azure CLI (
az) and local environment resolution scripts to manage tenant and environment IDs for Power Platform. Authentication secrets (like Entra ID client IDs) are handled by directing the user to official Microsoft portals and storing the resulting IDs in local configuration files (auth.config.json) following standard security practices for mobile app development.
Audit Metadata