plugin

pcf Review findings

Name: pcf
Author: Microsoft

Microsoftmicrosoft/power-platform-skillsupdated 2 days ago

Preview. Build, test, diagnose, upgrade, deploy, verify and inventory Power Apps component framework (PCF) code components for model-driven apps, with guided setup for Power Pages standard field controls and canvas apps, from Microsoft-maintained templates and recipes pinned to a tested version matrix. Requires Node.js 20+; PAC CLI and the .NET SDK to deploy; Azure CLI (az) to verify and inventory.

Microsoft's own description, from the plugin's files.

Engineering Design Documentsplugin

Stars: 1,109
Version: v1
Copies: 0

Overview Security15 Versions1 Files282

Overview

holdReview findings

Waxell's checks found 15 findings to review, highest severity high.

Highest severity: high
Findings: 15
What ran: Static analysis

A clean result means nothing alarming in what is published, not a guarantee. How the checks work

Skills in this plugin

We don't republish the plugin's instructions. Read them on GitHub at the reviewed commit.

Security

Security scan

Checked 2 days ago

Result

Review findings Waxell's checks found 15 findings to review, highest severity high.

Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work

Findings (15)

high · 15

high
Tells Claude to install unpinned packages (once, from, the, project, and, commit …)
scripts/lib/pcf-doctor.js:148 · skill_risk:S2
high
Tells Claude to install unpinned packages (in, the, project)
scripts/lib/pcf-upgrade.js:342 · skill_risk:S2
high
Tells Claude to install unpinned packages (failed, so, the, upgrade, was, rolled)
scripts/lib/pcf-upgrade.js:355 · skill_risk:S2
high
Tells Claude to install unpinned packages (@latest)
scripts/pcf-ci-build.js:176 · skill_risk:S2
high
Tells Claude to install unpinned packages (latest, failed, for)
scripts/pcf-ci-build.js:178 · skill_risk:S2
high
Tells Claude to install unpinned packages (@latest)
scripts/tests/pcf-ci-build.test.js:183 · skill_risk:S2
high
Tells Claude to install unpinned packages (@latest, failed)
scripts/tests/pcf-ci-build.test.js:184 · skill_risk:S2
high
Tells Claude to install unpinned packages (latest, failed, for, field-standard:, registry, unavailable/)
scripts/tests/pcf-ci-build.test.js:321 · skill_risk:S2
high
Tells Claude to install unpinned packages (should, not, run, on, a, dirty …)
scripts/tests/pcf-upgrade.test.js:485 · skill_risk:S2
high
Tells Claude to install unpinned packages (should, not, run, after, a, transform …)
scripts/tests/pcf-upgrade.test.js:554 · skill_risk:S2
high
Tells Claude to install unpinned packages (failed/)
scripts/tests/pcf-upgrade.test.js:767 · skill_risk:S2
high
Tells Claude to install unpinned packages (and, skips, install, when, requested)
scripts/tests/pcf-upgrade.test.js:822 · skill_risk:S2
high
Tells Claude to install unpinned packages (in, the)
scripts/tests/pcf-upgrade.test.js:854 · skill_risk:S2
high
Tells Claude to install unpinned packages (does, not, create, node_modules, Doctor, treats …)
scripts/tests/pcf-upgrade.test.js:865 · skill_risk:S2
high
Tells Claude to install unpinned packages (should, not, run)
scripts/tests/pcf-upgrade.test.js:918 · skill_risk:S2

Versions

Version history

Each distinct content we have seen, newest first, with the verdict it got at the time.

One version so far: v1 (1.0.1), seen 2026-11-03.

Files

282 files, 4.6 MB in total. Names only; open them on GitHub.

.claude-plugin/plugin.json
.plugin/plugin.json
AGENTS.md
CHANGELOG.md
README.md
compatibility-matrix.json
docs/pcf-capabilities.md
docs/pcf-design.md
hooks/hooks.json
hooks/run-skill-pretool-telemetry.js
hooks/run-user-prompt-telemetry.js
hooks/validate-write-safety.js
lock/standard/package-lock.json
lock/standard/package.json
lock/virtual/package-lock.json
lock/virtual/package.json
pipelines/README.md
pipelines/azure-devops.yml
pipelines/github-actions.yml
recipes/attachment-uploader/README.md
recipes/attachment-uploader/__tests__/{{name}}.test.ts.tmpl
recipes/attachment-uploader/recipe.json
recipes/attachment-uploader/{{name}}/adapters.ts.tmpl
recipes/attachment-uploader/{{name}}/css/{{name}}.css.tmpl
recipes/attachment-uploader/{{name}}/index.ts.tmpl
recipes/attachment-uploader/{{name}}/strings/{{name}}.1033.resx.tmpl
recipes/contextual-grid/README.md
recipes/contextual-grid/__tests__/{{name}}.test.ts.tmpl
recipes/contextual-grid/recipe.json
recipes/contextual-grid/{{name}}/css/{{name}}.css.tmpl
recipes/contextual-grid/{{name}}/fetchXmlData.ts.tmpl
recipes/contextual-grid/{{name}}/index.ts.tmpl
recipes/contextual-grid/{{name}}/strings/{{name}}.1033.resx.tmpl
recipes/grid-customizer/README.md
recipes/grid-customizer/__tests__/{{name}}.test.ts.tmpl
recipes/grid-customizer/recipe.json
recipes/grid-customizer/{{name}}/css/{{name}}.css.tmpl
recipes/grid-customizer/{{name}}/customizerBridge.ts.tmpl
recipes/grid-customizer/{{name}}/customizers/CellEditorOverrides.tsx.tmpl
recipes/grid-customizer/{{name}}/customizers/CellRendererOverrides.tsx.tmpl
recipes/grid-customizer/{{name}}/index.ts.tmpl
recipes/grid-customizer/{{name}}/strings/{{name}}.1033.resx.tmpl
recipes/grid-customizer/{{name}}/types.ts.tmpl
recipes/hierarchy-tree/README.md
recipes/hierarchy-tree/__tests__/{{name}}.test.ts.tmpl
recipes/hierarchy-tree/recipe.json
recipes/hierarchy-tree/{{name}}/css/{{name}}.css.tmpl
recipes/hierarchy-tree/{{name}}/index.ts.tmpl
recipes/hierarchy-tree/{{name}}/navigation.ts.tmpl
recipes/hierarchy-tree/{{name}}/strings/{{name}}.1033.resx.tmpl
recipes/lookup-dropdown/README.md
recipes/lookup-dropdown/__tests__/{{name}}.test.ts.tmpl
recipes/lookup-dropdown/recipe.json
recipes/lookup-dropdown/{{name}}/css/{{name}}.css.tmpl
recipes/lookup-dropdown/{{name}}/index.ts.tmpl
recipes/lookup-dropdown/{{name}}/lookupData.ts.tmpl
recipes/lookup-dropdown/{{name}}/strings/{{name}}.1033.resx.tmpl
recipes/star-rating/README.md
recipes/star-rating/__tests__/{{name}}.test.ts.tmpl
recipes/star-rating/recipe.json
recipes/star-rating/{{name}}/css/{{name}}.css.tmpl
recipes/star-rating/{{name}}/index.ts.tmpl
recipes/star-rating/{{name}}/strings/{{name}}.1033.resx.tmpl
references/pcf-best-practices.md
references/pcf-canvas.md
references/pcf-deploy.md
references/pcf-hosts.md
references/pcf-power-pages.md
references/pcf-recipes.md
references/pcf-testing.md
references/pcf-troubleshooting.md
scripts/check-auth.js
scripts/check-version.js
scripts/lib/cli-failure.js
scripts/lib/dataverse-auth.js
scripts/lib/interaction-mode.js
scripts/lib/nearest-name.js
scripts/lib/node-tool.js
scripts/lib/odata.js
scripts/lib/output-redaction.js
scripts/lib/pac-exec.js
scripts/lib/pcf-binding-verify.js
scripts/lib/pcf-build.js
scripts/lib/pcf-cli-flags.js
scripts/lib/pcf-code-gate.js
scripts/lib/pcf-dataverse.js
scripts/lib/pcf-doctor.js
scripts/lib/pcf-hook-utils.js
scripts/lib/pcf-intent.js
scripts/lib/pcf-manifest.js
scripts/lib/pcf-matrix.js
scripts/lib/pcf-names.js
scripts/lib/pcf-scaffold.js
scripts/lib/pcf-upgrade.js
scripts/lib/process-runner.js
scripts/lib/sdk-http-client.js
scripts/lib/source-literals.js
scripts/lib/telemetry/ikey.json
scripts/lib/telemetry/lib/agent-info.js
scripts/lib/telemetry/lib/emit-dispatcher.js
scripts/lib/telemetry/lib/emit-from-prompt.js
scripts/lib/telemetry/lib/emit-spawn.js
scripts/lib/telemetry/lib/events.js
scripts/lib/telemetry/lib/local-log.js
scripts/lib/telemetry/lib/native-exec.js
scripts/lib/telemetry/lib/pac-auth.js
scripts/lib/telemetry/lib/prompt-detector.js
scripts/lib/telemetry/lib/resolver-loader.js
scripts/lib/telemetry/lib/scrubber.js
scripts/lib/telemetry/lib/session.js
scripts/lib/telemetry/lib/telemetry-config.js
scripts/lib/telemetry/lib/user-config.js
scripts/lib/telemetry/region/artemis-service.js
scripts/lib/telemetry/region/region-cache.js
scripts/lib/telemetry/region/region-resolver.js
scripts/lib/telemetry/resolver.js
scripts/lib/telemetry/skill-completed.js
scripts/lib/utf8-stream.js
scripts/lib/xml-lite.js
scripts/lint-pcf.js
scripts/pcf-build.js
scripts/pcf-ci-build.js
scripts/pcf-doctor.js
scripts/pcf-gates.js
scripts/pcf-inventory.js
scripts/pcf-push.js
scripts/pcf-scaffold.js
scripts/pcf-upgrade.js
scripts/resolve-interaction-mode.js
scripts/run-tests.js
scripts/telemetry-config.js
scripts/tests/fixtures/pcf-formxml/bound-all-clients.xml
scripts/tests/fixtures/pcf-formxml/bound-web-only.xml
scripts/tests/fixtures/pcf-formxml/default-control-only.xml
scripts/tests/fixtures/pcf-formxml/duplicate-column-cells.xml
scripts/tests/fixtures/pcf-formxml/field-bound-roundtrip.xml
scripts/tests/fixtures/pcf-formxml/forcontrol-case-mismatch.xml
scripts/tests/fixtures/pcf-formxml/missing-description.xml
scripts/tests/fixtures/pcf-formxml/no-fallback-roundtrip-derived.xml
scripts/tests/fixtures/pcf-formxml/no-requested-column-roundtrip-derived.xml
scripts/tests/fixtures/pcf-formxml/phone-other-control-roundtrip-derived.xml
scripts/tests/fixtures/pcf-formxml/static-without-type.xml
scripts/tests/fixtures/pcf-formxml/subgrid-dataset-bound.xml
scripts/tests/fixtures/pcf-manifests/dataset-standard.xml
scripts/tests/fixtures/pcf-manifests/dataset-virtual.xml
scripts/tests/fixtures/pcf-manifests/field-standard.xml
scripts/tests/fixtures/pcf-manifests/field-virtual.xml
scripts/tests/fixtures/pcf-recipes/dataset-overlay/recipe.json
scripts/tests/fixtures/pcf-recipes/dataset-overlay/{{name}}/index.ts.tmpl
scripts/tests/fixtures/pcf-recipes/field-overlay/recipe.json
scripts/tests/fixtures/pcf-recipes/field-overlay/{{name}}/css/recipe.css.tmpl
scripts/tests/fixtures/pcf-recipes/field-overlay/{{name}}/index.ts.tmpl
scripts/tests/fixtures/pcf-recipes/planned-only/recipe.json
scripts/tests/fixtures/pcf-recipes/unsafe-overlay/recipe.json
scripts/tests/fixtures/pcf-recipes/unsafe-overlay/{{displayName}}.txt.tmpl
scripts/tests/fixtures/pcf-verify/001-intent-field-clean/pcf-intent.json
scripts/tests/fixtures/pcf-verify/003-intent-quickcreate-subgrid/pcf-intent.json
scripts/tests/golden/pcf-plan-example.md
scripts/tests/golden/pcf-plan-liquid.md
scripts/tests/helpers/big-results.js
scripts/tests/helpers/cli-harness.js
scripts/tests/helpers/fake-auth-check-preload.js
scripts/tests/helpers/fake-auth.js
scripts/tests/helpers/fake-big-org-preload.js
scripts/tests/helpers/golden.js
scripts/tests/helpers/huge-failure-preload.js
scripts/tests/helpers/mock-sdk.js
scripts/tests/helpers/push-token-child.js
scripts/tests/helpers/push-token.js
scripts/tests/helpers/queued-stdio-preload.js
scripts/tests/helpers/telemetry-fixtures.js
scripts/tests/helpers/telemetry-hook-tests.js
scripts/tests/helpers/telemetry-offline-preload.js
scripts/tests/helpers/write-order-preload.js
scripts/tests/model-apps-copies.test.js
scripts/tests/pcf-binding-verify.test.js
scripts/tests/pcf-build.test.js
scripts/tests/pcf-check-auth.test.js
scripts/tests/pcf-check-version.test.js
scripts/tests/pcf-ci-build.test.js
scripts/tests/pcf-cli-json-contract.test.js
scripts/tests/pcf-code-gate.test.js
scripts/tests/pcf-dataverse-real-bundle.test.js
scripts/tests/pcf-dataverse.test.js
scripts/tests/pcf-doctor.test.js
scripts/tests/pcf-exit-writes-inventory.test.js
scripts/tests/pcf-gates.test.js
scripts/tests/pcf-intent.test.js
scripts/tests/pcf-inventory.test.js
scripts/tests/pcf-lint-cli.test.js
scripts/tests/pcf-lock-scripts.test.js
scripts/tests/pcf-manifest.test.js
scripts/tests/pcf-matrix.test.js
scripts/tests/pcf-names.test.js
scripts/tests/pcf-node-tool.test.js
scripts/tests/pcf-pac-exec.test.js
scripts/tests/pcf-pages-guard.test.js
scripts/tests/pcf-pipelines.test.js
scripts/tests/pcf-printers-whole-before-exit.test.js
scripts/tests/pcf-projects-workflow.test.js
and 82 more

See and control which skills your people use

Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

More engineering skills and plugins

See all