setup-offline-profile

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Command Execution: The skill utilizes Bash to run internal scripts and standard shell commands (e.g., test, echo). These operations are used for environment resolution, verifying project structure, and interacting with the Dataverse API via vendor-provided scripts.
  • Dynamic Execution: Small JavaScript snippets are executed using node -e to parse project-specific files like power.config.json and app.config.js, and to write the final offline-profile.json configuration. These are controlled snippets used to facilitate local project automation.
  • Indirect Prompt Injection Consideration: The skill ingests data from local configuration files and processed outputs from other agents. While this represents a surface where external data enters the agent context, the risk is considered low as the sources are typical project artifacts and the skill uses structured workflows.
  • Agent Orchestration: The skill uses the Task tool to delegate complex design tasks to a specialized architect agent (mobile-app:offline-profile-architect). This is a standard multi-agent collaboration pattern for handling modular tasks.
  • Environment Interaction: The skill communicates with Microsoft Dataverse environment URLs and uses the az CLI for authentication. These operations are essential for the skill's primary purpose and involve trusted vendor services.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 12:56 PM
Security Audit — agent-trust-hub — setup-offline-profile