pcf
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill automates PCF development tasks by executing a series of local Node.js scripts located in the plugin directory (e.g.,
pcf-doctor.js,pcf-scaffold.js,pcf-push.js). These scripts handle diagnostics, scaffolding, and deployment tasks within the Power Apps ecosystem. - External Resource Integration: The workflow references official Microsoft Learn documentation and integrates with Microsoft-maintained tools such as Power Platform GitHub Actions and Azure DevOps Build Tools. These are well-known, trusted resources for the development tasks described.
- Dependency Management: The skill guides the user through standard project setup using
npm installandnpm cifor managing Node.js dependencies, as well asdotnet buildfor solution packaging. These are standard practices in component development. - Indirect Prompt Injection Surface: The skill ingests and processes
ControlManifest.Input.xmlandpcf-intent.json. To manage the risk of processing potentially untrusted data, the skill includes a structured planning phase (write-pcf-plan.js) and a human-in-the-loop approval process before major actions are taken.
Audit Metadata