publish-pcf-companion

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • Command Execution: The skill uses the Bash tool to execute standard development commands, such as npm run build and pac pcf push. These operations are essential for the skill's purpose of building and deploying software components to the user's environment.
  • Environment Verification: The skill implements a security-conscious pattern by explicitly displaying and requiring confirmation of the target environment URL and user identity from pac org who before proceeding with any deployment. This practice helps prevent accidental deployments to incorrect or production environments.
  • Tool Management: The skill provides automated assistance for setting up the Microsoft Power Platform CLI (pac) if it is missing. This involves installing the tool through the .NET SDK, which is a standard procedure for this development ecosystem.
  • Data Ingestion for Configuration: The skill reads local metadata from PRD.md and ControlManifest.Input.xml to determine project naming and versioning. This input is used to configure the deployment parameters, such as the publisher prefix and version bump settings.
  • User Confirmation Gates: The inclusion of three distinct gates (publisher prefix, version-bump, and environment confirmation) ensures that the user maintains control over the critical parameters of the deployment process.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:29 AM
Security Audit — agent-trust-hub — publish-pcf-companion