pcf

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill automates PCF development tasks by executing a series of local Node.js scripts located in the plugin directory (e.g., pcf-doctor.js, pcf-scaffold.js, pcf-push.js). These scripts handle diagnostics, scaffolding, and deployment tasks within the Power Apps ecosystem.
  • External Resource Integration: The workflow references official Microsoft Learn documentation and integrates with Microsoft-maintained tools such as Power Platform GitHub Actions and Azure DevOps Build Tools. These are well-known, trusted resources for the development tasks described.
  • Dependency Management: The skill guides the user through standard project setup using npm install and npm ci for managing Node.js dependencies, as well as dotnet build for solution packaging. These are standard practices in component development.
  • Indirect Prompt Injection Surface: The skill ingests and processes ControlManifest.Input.xml and pcf-intent.json. To manage the risk of processing potentially untrusted data, the skill includes a structured planning phase (write-pcf-plan.js) and a human-in-the-loop approval process before major actions are taken.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 10:18 PM