skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

audit-ppmplugin

Statically audits built .ppmplugin bundles for manifest, DEX, and iOS framework defects.

808|167|Updated Jan 21, 2026
Search Tags:#static analysis#audit#manifest validation#dex#ios framework#Power Apps#ppmplugin
One-click install
npx skills add https://github.com/microsoft/power-platform-skills --skill audit-ppmplugin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-ppmplugin
Source: https://github.com/microsoft/power-platform-skills/tree/main/plugins/power-apps-mobile-extension/skills/audit-ppmplugin
Command: npx skills add https://github.com/microsoft/power-platform-skills --skill audit-ppmplugin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Built .ppmplugin bundles often fail silently after upload — a native module fails to load, the runtime cannot instantiate the package class, or the upload is rejected with a canonical-prefix violation — and each failure costs a full wrap-build round-trip to discover. This Skill statically inspects the finished bundle on disk and surfaces those defects in seconds, before wrap testing.

Core Features & Use Cases

  • Archive and manifest validation: Checks zip layout, manifest schema, canonical-prefix and reserved-name rules, and manifest-to-binary consistency against the declared entrypoints.
  • Platform binary inspection: Verifies Android DEX magic, package-class presence, and SDK-symbol leakage, plus iOS flat-framework structure, Info.plist, and module-class naming.
  • Source-to-receiver contract checks: When source is reachable, confirms getName() matches receivers, methods are annotated, constructors are no-arg, and sibling PCFs dispatch via sendAsync with a raw object payload.
  • Use Case: After running /assemble-ppmplugin on a pen-input extension, run this audit to catch a CRITICAL cordova.exec call in the PCF and a missing no-arg constructor before uploading to Dataverse.

Quick Start

Audit the .ppmplugin bundle in the ppmplugin folder and report any CRITICAL findings with fixes.

Frequently Asked Questions about audit-ppmplugin

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify a .ppmplugin bundle before uploading to Dataverse?▼

Run the audit on the built .ppmplugin file; it extracts the archive to a temp directory and checks zip structure, manifest rules, DEX integrity, and iOS framework layout. It reports CRITICAL, WARNING, and INFO findings with fixes routed to the owning build skill.

What tools are required to audit a .ppmplugin file?▼

The audit requires jar from a JDK to list and extract the bundle. For Android DEX inspection, dexdump from the Android SDK build-tools is preferred, with strings as a fallback; without either, DEX string checks degrade to warnings while structural checks still run.

Does the audit modify or patch the .ppmplugin bundle?▼

No, the audit is strictly read-only on the bundle. It unzips to a temporary directory for inspection and routes every fix upstream to the manifest generator or build skills, after which you re-assemble and re-audit.

Why does my plugin fail with 'native module not loaded' on device?▼

This usually means the Kotlin module's getName() literal does not match the manifest's receivers[].nativeModule value, or the package class lacks a public no-arg constructor. The audit's source-to-receiver checks catch both mismatches statically before deployment.

Can the audit run without access to the extension source code?▼

Yes, archive, manifest, DEX, and iOS framework checks run on the bundle alone. Source-dependent checks such as getName() matching and PCF sendAsync validation are marked SKIPPED when the source tree is not reachable.

What are the limitations of the local manifest name checks?▼

The audit only checks a known subset of incompatible exact native-module names locally, so a clean result does not guarantee the upload service will accept the name. Reserved-prefix and generic-noun heuristics reduce but do not eliminate server-side rejection risk.

Related Skills

Explore More Software Engineering Skills→
SageV1SageV1
1

makepad-deployment

Automate Makepad app packaging into desktop installers, mobile apps, and web bundles.

Community
Advanced
markus41markus41
12

Power Apps Development

Automate Power Apps development workflows for canvas apps and Dataverse integration.

Community
Advanced
kunal-10-cloudkunal-10-cloud

mobile-perf-audit

Automate performance auditing of Expo React Native mobile apps.

Community
Advanced
patleemanpatleeman
22

local-extension-development

Build, validate, and reload Neon Pilot native extensions in-app.

Community
Advanced