Build third-party Power Apps Mobile (PAM) controls into a prebuilt .ppmplugin binary (Android DEX + flat iOS .framework + manifest.json) for the wrap runtime. Public tooling only; recommended build entry point /generate-ppmplugin.
- Stars
- 1,109
- Version
- v1
- Copies
- 0
Overview
Waxell's checks found 4 findings to review, highest severity high.
- Highest severity
- high
- Findings
- 4
- What ran
- Static analysis
A clean result means nothing alarming in what is published, not a guarantee. How the checks work
Skills in this plugin
- assemble-ppmpluginMicrosoftAssemble the final `.ppmplugin` binary bundle for a PAM native extension and verify its contents. First **reconciles** the manifest's… No issuesDesignFinance1.1k
- audit-ppmpluginMicrosoftStatically audit a built `.ppmplugin` before wrap testing. Checks archive layout, manifest compatibility, bundle consistency, Android DEX… No issuesEngineeringDesign1.1k
- build-android-binaryMicrosoftCompile a PAM control's Android Kotlin module into the runtime-loadable DEX for a `.ppmplugin`. Creates a staged Gradle build with the… No issuesEngineering1.1k
- build-ios-binaryMicrosoftCompile a PAM control's iOS Obj-C/Swift module into the FLAT device-slice `.framework` for a `.ppmplugin` bundle (never an `.xcframework`,… No issuesEngineering1.1k
- debug-extensionMicrosoftDiagnose and fix failures in a built third-party `.ppmplugin` control: crashes, silent no-ops, PCF error outputs, or incorrect behavior.… No issuesEngineeringDocuments1.1k
- design-native-extension-featureMicrosoftCapture a 2-3 line pitch from the user, draft a product overview (PRD.md) and a technical design (ARCHITECTURE.md) for a third-party… No issuesDesignEngineering1.1k
- generate-native-extensionMicrosoftRead the approved PRD.md and generate the native sources for a third-party PAM control (the compiled `.ppmplugin` track), iOS Obj-C… No issuesEngineeringDesign1.1k
- generate-pcf-companionMicrosoftGenerate the dispatcher PCF for a third-party `.ppmplugin` (wrap-runtime) control. Runs `pac pcf init` in the pcf/ subfolder, rewrites… Review findingsEngineeringDesign1.1k
- generate-ppmpluginMicrosoftBuild and verify a third-party `.ppmplugin` end to end. This recommended entry point detects Android and iOS source, confirms target… No issuesEngineering1.1k
We don't republish the plugin's instructions. Read them on GitHub at the reviewed commit.
Security
Security scan
Checked 2 days ago
Result
Review findings Waxell's checks found 4 findings to review, highest severity high.
Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work
Findings (4)
high · 4
- high
Tells Claude to install unpinned packages (cocoapods)
shared/prereq-check.md:21 · skill_risk:S2
- high
Tells Claude to install unpinned packages (tsc, under, pcf/)
skills/generate-pcf-companion/SKILL.md:33 · skill_risk:S2
- high
Tells Claude to install unpinned packages (tooling, pulls, from, the, public, npm …)
skills/generate-pcf-companion/SKILL.md:1067 · skill_risk:S2
- high
Tells Claude to install unpinned packages (npm, run, build)
skills/publish-pcf-companion/SKILL.md:26 · skill_risk:S2
Versions
Version history
Each distinct content we have seen, newest first, with the verdict it got at the time.
One version so far: v1 (0.2.0), seen 2026-11-03.
Files
Files
49 files, 755 KB in total. Names only; open them on GitHub.
- .claude-plugin/plugin.json
- .plugin/plugin.json
- AGENTS.md
- README.md
- hooks/hooks.json
- hooks/run-telemetry.js
- scripts/lib/telemetry/config.js
- scripts/lib/telemetry/dispatcher.js
- scripts/lib/telemetry/ikey.json
- scripts/lib/telemetry/lib/agent-info.js
- scripts/lib/telemetry/lib/emit-dispatcher.js
- scripts/lib/telemetry/lib/emit-from-prompt.js
- scripts/lib/telemetry/lib/emit-spawn.js
- scripts/lib/telemetry/lib/events.js
- scripts/lib/telemetry/lib/local-log.js
- scripts/lib/telemetry/lib/native-exec.js
- scripts/lib/telemetry/lib/pac-auth.js
- scripts/lib/telemetry/lib/prompt-detector.js
- scripts/lib/telemetry/lib/resolver-loader.js
- scripts/lib/telemetry/lib/scrubber.js
- scripts/lib/telemetry/lib/session.js
- scripts/lib/telemetry/lib/telemetry-config.js
- scripts/lib/telemetry/lib/user-config.js
- scripts/lib/telemetry/routing.js
- scripts/lib/telemetry/schema.js
- scripts/telemetry-config.js
- scripts/tests/telemetry.test.js
- shared/error-codes.md
- shared/framework-recommendations.md
- shared/naming-conventions.md
- shared/ppmplugin-format.md
- shared/prereq-check.md
- shared/repo-layout.md
- shared/self-critique-protocol.md
- shared/shared-instructions.md
- shared/telemetry.md
- skills/assemble-ppmplugin/SKILL.md
- skills/audit-ppmplugin/SKILL.md
- skills/build-android-binary/SKILL.md
- skills/build-ios-binary/SKILL.md
- skills/debug-extension/SKILL.md
- skills/design-native-extension-feature/SKILL.md
- skills/generate-native-extension/SKILL.md
- skills/generate-pcf-companion/SKILL.md
- skills/generate-ppmplugin-manifest/SKILL.md
- skills/generate-ppmplugin/SKILL.md
- skills/publish-pcf-companion/SKILL.md
- skills/telemetry/SKILL.md
- skills/test-native-extension/SKILL.md
See and control which skills your people use
Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.
30 minutes. No commitment.
SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF
More other skills and plugins
- telemetryMicrosoftEnable, disable, or check usage telemetry transmission for Power Apps Mobile Extension skills. Use for 'turn off telemetry', 'opt out',… No issuesOther1.1k
- manage-desktop-flowsMicrosoftManage and run Power Automate Desktop (RPA) flows and machine groups. Use when the user asks about desktop flows, RPA, or machine groups. No issuesOther1.1k
- compare-cohortsMicrosoftUse when comparing process cohorts, departments, periods or before-and-after results under matched definitions. No issuesOther1.1k
- derive-metricMicrosoftUse when a requested measure is missing, a saved custom metric needs reuse, or an ephemeral formula or derived scalar is needed. No issuesOther1.1k