skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

scan-site

Runs security scans on deployed Power Pages sites and summarizes findings by severity.

808|167|Updated Jan 21, 2026
Search Tags:#vulnerability assessment#security scan#site audit#power platform#Power Pages#PAC CLI#scan report
One-click install
npx skills add https://github.com/microsoft/power-platform-skills --skill scan-site
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-site
Source: https://github.com/microsoft/power-platform-skills/tree/main/plugins/power-pages/skills/scan-site
Command: npx skills add https://github.com/microsoft/power-platform-skills --skill scan-site

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Deployed Power Pages sites can expose vulnerabilities on their public surface, but running a security scan, waiting for it to finish, and interpreting the raw report requires manual API calls and technical expertise. This Skill automates the full scan lifecycle and translates results into plain-language findings.

Core Features & Use Cases

  • Automated Deep Scans: Starts a server-side security scan on the live site, polls for completion in the background, and handles already-running or timed-out scans gracefully.
  • Plain-Language Reporting: Fetches the latest scan report, maps risk levels to severities, renders a timestamped HTML report, and summarizes findings without technical jargon.
  • Guided Remediation: Routes findings to the right follow-up skills, such as /manage-headers for header issues, /manage-firewall for WAF issues, or /setup-auth for identity issues.
  • Use Case: A site owner asks "is my production site vulnerable?" — the Skill resolves the site, checks scan state, runs or reuses a scan, and delivers a severity-grouped summary with recommended fixes.

Quick Start

Ask the assistant to scan your deployed Power Pages site for security issues and show a summary of the latest report.

Frequently Asked Questions about scan-site

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security scan on a Power Pages site?▼

Invoke the scan-site skill after deploying your site. It resolves the website record id from .powerpages-site/website.yml, starts a deep scan via the Power Platform API, polls for completion in the background, and summarizes findings by severity.

How long does a Power Pages deep scan take?▼

Duration depends on site size: small sites finish in minutes, while large sites can take hours. The polling script defaults to a 20-minute timeout, which you can increase with the --timeoutMinutes flag for larger sites.

Can I view previous scan results without running a new scan?▼

Yes. The skill checks scan state first and can fetch the latest completed report with get-latest-report.js. If a recent report exists, it recommends using it instead of triggering a new multi-minute scan.

Why does the scan say a scan is already running?▼

Only one scan per site can run at a time. Starting another returns code Z003, reported as status already-running. The skill then attaches to the in-progress scan and polls until it finishes instead of failing.

Does the scan check my local source code?▼

No. The scan runs server-side against the live deployed site's public surface, not local files. For code-level issues like exposed debug pages, the skill suggests manual fixes rather than scanning source.

What sign-in is required to scan a Power Pages site?▼

Scripts exit with code 2 when authentication is missing. Fix it by running pac auth create or az login, then retry. The authenticated profile must point at the environment containing the site.

Related Skills

Explore More Software Engineering Skills→
microsoftmicrosoft
647

activate-site

Automate Power Pages site provisioning with PAC CLI and Azure CLI prerequisites.

Official
Advanced
trailofbitstrailofbits
6.5k

insecure-defaults

Detect insecure default configurations with hardcoded secrets and weak authentication.

Official
Intermediate
dapperdiversdapperdivers
1

run-full-scan

Orchestrate reconnaissance, vulnerability scanning, source auditing, and report generation for penetration tests.

Community
Advanced
openaeonopenaeon
87

nano-pdf

Edits a specific page of a PDF using natural-language instructions.

Community
Basic