Waxell

plugin

mobile-app Review findings

Microsoftmicrosoft/power-platform-skillsupdated

Browse GitHub Download zipBook a demo
Build and deploy Power Apps code apps for mobile using Expo (React Native), with native device functionality and Power Platform connectors
Microsoft's own description, from the plugin's files.
Engineeringplugin
Stars
1,109
Version
v1
Copies
0
OverviewSecurity8Versions1Files280

Overview

holdReview findings

Waxell's checks found 8 findings to review, highest severity high.

Highest severity
high
Findings
8
What ran
Static analysis

A clean result means nothing alarming in what is published, not a guarantee. How the checks work

Skills in this plugin

We don't republish the plugin's instructions. Read them on GitHub at the reviewed commit.

Security

Security scan

Checked 2 days ago

Result

Review findings Waxell's checks found 8 findings to review, highest severity high.

Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work

Findings (8)

high · 6

  • high

    Tells Claude to install unpinned packages (will, catch)

    hooks/validate-package-deps.js:201 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (failed)

    scripts/tests/app-docs.test.js:1247 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (already, happened, before, skill, invocation)

    skills/create-mobile-app/SKILL.md:614 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (in, the, template, folder, and, rerun)

    skills/create-mobile-app/SKILL.md:1744 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (require, the, expected, npm, lockfile, matching …)

    skills/debug-app/references/startup-diagnostics.md:169 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (or, native, builds, from, this, skill)

    skills/set-app-registration-native/SKILL.md:248 · skill_risk:S2

info · 2

  • info

    microsoft-learn: connects to learn.microsoft.com (verified in the MCP catalog)

    .mcp.json · mcp_risk:M9

  • info

    template/assets/adaptive-icon.png: PNG image

    template/assets/adaptive-icon.png · binary_risk:B6

Versions

Version history

Each distinct content we have seen, newest first, with the verdict it got at the time.

One version so far: v1 (0.6.0), seen 2026-11-03.

Files

Files

280 files, 4.0 MB in total. Names only; open them on GitHub.

  • .claude-plugin/plugin.json
  • .mcp.json
  • .plugin/plugin.json
  • AGENTS.md
  • OFFICE_HOURS.md
  • README.md
  • agents/data-model-architect.md
  • agents/native-app-planner.md
  • agents/offline-profile-architect.md
  • agents/screen-builder.md
  • agents/screen-planner.md
  • assets/README.md
  • assets/power-apps-icon.svg
  • assets/run-plan.html
  • docs/base-template-quality-fixes.md
  • hooks/README.md
  • hooks/hooks.json
  • hooks/run-telemetry.js
  • hooks/validate-color-contrast.js
  • hooks/validate-connector-first.js
  • hooks/validate-dataverse-heavy-lists.js
  • hooks/validate-dataverse-payload.js
  • hooks/validate-icon-imports.js
  • hooks/validate-navigation-idempotency.js
  • hooks/validate-package-deps.js
  • hooks/validate-protected-paths.js
  • hooks/validate-screen-quality.js
  • hooks/validate-write-safety.js
  • scripts/app-docs.js
  • scripts/build-dataverse-operation-manifest.js
  • scripts/capture-empirical-answers.js
  • scripts/check-routes.js
  • scripts/check-version.js
  • scripts/create-calculated-column.js
  • scripts/create-dataverse-snapshot.js
  • scripts/dataverse-inventory-cache.js
  • scripts/dataverse-request.js
  • scripts/detect-publisher-prefix.js
  • scripts/discover-app-registrations.js
  • scripts/emit-telemetry-checkpoint.js
  • scripts/inspect-startup.js
  • scripts/lib/app-identity.js
  • scripts/lib/azure-cli.js
  • scripts/lib/derived-metadata.js
  • scripts/lib/environment-resolution.js
  • scripts/lib/mobile-lifecycle.js
  • scripts/lib/mobile-telemetry-config.js
  • scripts/lib/mobile-telemetry-context.js
  • scripts/lib/mobile-telemetry-dispatcher.js
  • scripts/lib/mobile-telemetry-session.js
  • scripts/lib/mobile-telemetry.js
  • scripts/lib/mobile-validator-manifest.js
  • scripts/lib/mobileapp-hook-utils.js
  • scripts/lib/process-runner.js
  • scripts/lib/render-template.js
  • scripts/lib/sanitize-external-content.js
  • scripts/lib/telemetry/ikey.json
  • scripts/lib/telemetry/lib/agent-info.js
  • scripts/lib/telemetry/lib/emit-dispatcher.js
  • scripts/lib/telemetry/lib/emit-from-prompt.js
  • scripts/lib/telemetry/lib/emit-spawn.js
  • scripts/lib/telemetry/lib/events.js
  • scripts/lib/telemetry/lib/local-log.js
  • scripts/lib/telemetry/lib/native-exec.js
  • scripts/lib/telemetry/lib/pac-auth.js
  • scripts/lib/telemetry/lib/prompt-detector.js
  • scripts/lib/telemetry/lib/resolver-loader.js
  • scripts/lib/telemetry/lib/scrubber.js
  • scripts/lib/telemetry/lib/session.js
  • scripts/lib/telemetry/lib/telemetry-config.js
  • scripts/lib/telemetry/lib/user-config.js
  • scripts/lib/telemetry/region/artemis-service.js
  • scripts/lib/telemetry/region/region-resolver.js
  • scripts/lib/telemetry/resolver.js
  • scripts/lib/validation-helpers.js
  • scripts/list-table-columns.js
  • scripts/offline-profile-delta.js
  • scripts/open-wrap-url.js
  • scripts/prepare-mobile-template.js
  • scripts/redact-debug-diagnostic.js
  • scripts/render-dataverse-architect-evidence.js
  • scripts/render-dataverse-planning-evidence.js
  • scripts/resolve-environment.js
  • scripts/run-with-telemetry.sh
  • scripts/tests/app-docs.test.js
  • scripts/tests/app-edit-routing-contract.test.js
  • scripts/tests/app-working-directory-contract.test.js
  • scripts/tests/auth-token-resolution.test.js
  • scripts/tests/camera-helper-example.test.js
  • scripts/tests/check-routes.test.js
  • scripts/tests/check-version.test.js
  • scripts/tests/create-mobile-app-planning-order.test.js
  • scripts/tests/create-mobile-app-quality-contract.test.js
  • scripts/tests/data-model-edit-scope-contract.test.js
  • scripts/tests/dataverse-architect-evidence.test.js
  • scripts/tests/dataverse-candidate-relevance.test.js
  • scripts/tests/dataverse-inventory-cache.test.js
  • scripts/tests/dataverse-operation-manifest.test.js
  • scripts/tests/dataverse-planning-decisions.test.js
  • scripts/tests/dataverse-planning-snapshot.test.js
  • scripts/tests/dataverse-progressive-detail.test.js
  • scripts/tests/dataverse-read-concurrency.test.js
  • scripts/tests/dataverse-request-metadata-batch.test.js
  • scripts/tests/derived-metadata.test.js
  • scripts/tests/design-dark-palette-contract.test.js
  • scripts/tests/discover-app-registrations.test.js
  • scripts/tests/helpers/fake-az-preload.js
  • scripts/tests/helpers/markdown-shell-blocks.js
  • scripts/tests/helpers/startup-scenario.js
  • scripts/tests/inspect-startup.test.js
  • scripts/tests/metro-logging-contract.test.js
  • scripts/tests/mobile-telemetry-hooks.test.js
  • scripts/tests/mobile-telemetry-lifecycle.test.js
  • scripts/tests/mobile-telemetry-region.test.js
  • scripts/tests/mobile-telemetry-replay.test.js
  • scripts/tests/mobile-telemetry.test.js
  • scripts/tests/mobileapp-hook-utils.test.js
  • scripts/tests/native-helper-reuse-contract.test.js
  • scripts/tests/npx-no-install-contract.test.js
  • scripts/tests/offline-helper-root-contract.test.js
  • scripts/tests/offline-profile-delta.test.js
  • scripts/tests/power-apps-cli-dataverse-contract.live.test.js
  • scripts/tests/prepare-mobile-template.test.js
  • scripts/tests/process-runner.test.js
  • scripts/tests/redact-debug-diagnostic.test.js
  • scripts/tests/render-template.test.js
  • scripts/tests/resolve-environment-quality.test.js
  • scripts/tests/resolve-environment.test.js
  • scripts/tests/run-plan-page.test.js
  • scripts/tests/scoped-dataverse-planning-contract.test.js
  • scripts/tests/startup-diagnostics-contract.test.js
  • scripts/tests/template-agent-guidance.test.js
  • scripts/tests/template-quality-contract.test.js
  • scripts/tests/validate-mobile-files-all-source.test.js
  • scripts/tests/validate-package-deps.test.js
  • scripts/tests/verify-dataverse-services.test.js
  • scripts/update-entity-offline-flags.js
  • scripts/validate-dataverse-planning-decisions.js
  • scripts/validate-derived-metadata.js
  • scripts/validate-mobile-files.js
  • scripts/verify-dataverse-access.js
  • scripts/verify-dataverse-services.js
  • scripts/verify-offline-profile.js
  • shared/.gitkeep
  • shared/cli-binary.md
  • shared/connector-reference.md
  • shared/memory-bank.md
  • shared/preferred-environment.md
  • shared/references/accessibility-checklist.md
  • shared/references/app-edit-routing.md
  • shared/references/app-working-directory.md
  • shared/references/color-palette-architecture.md
  • shared/references/connectivity-intent-ownership.md
  • shared/references/connector-planning.md
  • shared/references/data-performance.md
  • shared/references/data-source-removal.md
  • shared/references/dataverse-change-planning.md
  • shared/references/dataverse-offline-api.md
  • shared/references/design-planning.md
  • shared/references/javascript-dependency-planning.md
  • shared/references/mcp-design-queries.md
  • shared/references/mobile-design-philosophy.md
  • shared/references/mobile-gesture-recipes.md
  • shared/references/mobile-ui-patterns.md
  • shared/references/native-artifact-compatibility.md
  • shared/references/offline-profile-reconciliation.md
  • shared/references/offline-profile-schema.md
  • shared/references/power-pages-defaults.md
  • shared/references/screen-templates.md
  • shared/references/tamagui-component-recipes.md
  • shared/references/tamagui-custom-tokens.md
  • shared/references/tamagui-html-mapping.md
  • shared/references/typography-and-tone.md
  • shared/references/universal-patterns.md
  • shared/samples/_layout-drawer.tsx
  • shared/samples/_layout.tsx
  • shared/samples/screen-detail.tsx
  • shared/samples/screen-form.tsx
  • shared/samples/screen-industry-dashboard.tsx
  • shared/samples/screen-industry-field.tsx
  • shared/samples/screen-list.tsx
  • shared/samples/src/components/index.tsx
  • shared/samples/src/hooks/index.ts
  • shared/samples/src/hooks/useCursorListData.ts
  • shared/samples/src/hooks/useListData.ts
  • shared/samples/src/hooks/useSearchFilter.ts
  • shared/samples/src/tokens/index.ts
  • shared/samples/src/utils/choices.ts
  • shared/samples/src/utils/dataverse.ts
  • shared/samples/src/utils/formatters.ts
  • shared/samples/src/utils/index.ts
  • shared/samples/src/utils/text.ts
  • shared/samples/tamagui.config.ts
  • shared/shared-instructions.md
  • shared/version-check.md
  • skills/add-connector/SKILL.md
  • skills/add-datasource/SKILL.md
  • skills/add-dataverse/SKILL.md
  • skills/add-dataverse/references/dataverse-reference.md
  • skills/add-native/SKILL.md
  • and 80 more

See and control which skills your people use

Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

More engineering skills and plugins

See all