$ loading_
对 Power Pages 站点执行端到端安全审查，并汇总生成完整 HTML 报告。
该技能材料显示其主要是用于编排一次 Power Pages 安全检查流程，且系统客观检查项已标注为 prompt-only、开源、无密钥、无远程端点。基于现有材料，整体风险偏低，但 README 中包含要求执行本地 node 脚本和使用本地文件/临时目录的指令，因此在代码执行、数据访问与供应链维度仍需留意。
材料与客观检查项均表明不需要任何密钥或环境变量，未见请求令牌、口令或第三方账户凭证的描述，凭证泄露面较小。
系统检查项列明无远程端点，材料中也未声明向外部服务发送数据；虽提到审查 live site/browser headers/firewall，但现有摘录未给出任何第三方外发目标。
README 明确包含执行本地命令的指令：运行 `node "${CLAUDE_PLUGIN_ROOT}/scripts/check-version.js"`，并要求使用 Glob、创建工作目录、调用其他技能。此类本地执行/编排属于工具常规能力，但应确认宿主仅按预期范围运行。
材料说明会查找 `**/powerpages.config.json`、确认 `.powerpages-site/website.yml`、在 `<SYSTEM_TEMP>/security-review/` 创建临时目录，并汇总生成 HTML 报告，说明其会访问本地项目配置与生成本地输出。当前未见超出声明用途的过度授权证据。
正面因素是 GitHub 开源仓库且可审计；但社区采用为 0 star、许可证未声明、维护状态未知，且材料中引用插件根目录脚本与其他技能，供应链透明度和持续维护证据有限，因此建议审阅仓库内容后使用。
复制安装指令，让 AI 自动完成配置 · 推荐新手
请帮我安装 askskill 上的 "security-review" 技能： 1. 下载 https://raw.githubusercontent.com/microsoft/power-platform-skills/main/plugins/power-pages/skills/security-review/SKILL.md 2. 保存为 ~/.claude/skills/security-review/SKILL.md 3. 装好后重载技能，告诉我可以用了
请对我们的 Power Pages 站点做一次完整安全审查，重点检查线上站点、浏览器安全头、防火墙、身份验证和角色权限，并输出一份适合发布前验收的 HTML 报告。
一份汇总各项安全发现、风险说明与整改建议的 HTML 安全审查报告。
我正在开发一个 Power Pages 门户，请帮我检查当前站点的访问控制与安全配置，确认身份验证、角色权限和防护设置是否存在问题，并输出完整报告。
一份指出配置错误、权限风险和安全缺口的 HTML 报告，便于开发阶段修复。
请对这个 Power Pages 站点做安全巡检，评估它当前是否安全，并持续关注线上暴露面、请求头、防火墙与登录相关设置的风险。
一份面向日常巡检的安全报告，汇总当前状态、潜在风险点和后续处理建议。
Plugin check: Run
node "${CLAUDE_PLUGIN_ROOT}/scripts/check-version.js"— if it outputs a message, show it to the user before proceeding.
Guide the user through a full security review of their Power Pages site. Runs the matching focused skills and assembles every finding into a single HTML report.
The skill never asks the user technical questions. The conversation stays in plain language.
Initial request: $ARGUMENTS
The skill has six phases. Phases 2–5 each map to one conversation beat with the user; phases 1 and 6 are silent setup and cleanup. See references/flow.md for the rationale behind each beat.
| Phase | What happens | User-facing beat |
|---|---|---|
| 1 — Prerequisites | Locate project, set up working folders | (silent setup) |
| 2 — Scope | Capture goal — one question, three answers, plain language | Ask the goal |
| 3 — Skills | Run the matching skills, surface progress | Scan in progress |
| 4 — Report | Build the consolidated report — totals + per-section findings | Results summary + Findings |
| 5 — Present | Present results, offer remediation follow-ups | Next steps and guidance |
| 6 — Cleanup | Remove temporary files | (silent cleanup) |
Create tasks in three groups. Mark each in_progress when starting, completed when done.
Group 1 — create at the start of prerequisites:
| Task subject | activeForm |
|---|---|
| Check prerequisites | Checking prerequisites |
Only this one task. Do not create any other tasks until prerequisites complete.
Group 2 — create after prerequisites complete:
| Task subject | activeForm |
|---|---|
| Capture goal | Capturing goal |
Group 3 — create after the goal is captured:
| Task subject | activeForm |
|---|---|
| Run skills | Running checks |
| Build the report | Building the report |
| Present findings | Presenting findings |
| Clean up | Cleaning up |
Use Glob to find **/powerpages.config.json. If none is found, tell the user the site needs to be created first with /create-site, then stop.
For the monitor and release goals (any goal that delegates to scan-site or manage-firewall), also confirm that .powerpages-site/website.yml exists. If it does not, the site has not been deployed yet — tell the user (in plain language) the site needs to be deployed once before a live security review can run, recommend /deploy-site, then stop. Do not try to identify the site by name or URL — different sites can share the same name.
For the access-config goal, the deploy check is not required: authentication, web roles, and table permissions are read from local YAML alone.
Create a fresh working directory: <SYSTEM_TEMP>/security-review/. The folder holds JSON data files emitted by each skill in review mode. The folder is removed in the cleanup step.
If the folder already exists from a previous interrupted run, delete its contents (not the folder itself) before continuing.
The final HTML always lives at <PROJECT_ROOT>/docs/security-review-<YYYY-MM-DD-HHMMSS>.html using the local timestamp at the start of the run (e.g. security-review-2026-05-14-053805.html). Always include the timestamp — do not use a bare security-review.html name. This keeps each run's report distinct.
Ask the user with a single AskUserQuestion call. If the user's initial request already answers it, skip and continue.
Question — What to review?
| Label | Description |
|---|---|
| Access & config | Check authentication, web roles, and table permissions. Works on local files only. |
| Release readiness | Full review before publishing — checks everything. (Recommended) |
…
对已部署的 Power Pages 站点执行安全扫描并生成通俗风险摘要。
帮助你快速搭建 Power Platform 管道，实现 Power Pages 自动化部署。
检查并配置 Power Pages 站点安全响应头，定位风险并指导修复设置。
用于对已部署的 Power Pages 网站进行运行时浏览、爬取与接口验证测试。
帮助你为 Power Apps 代码应用添加数据源或连接器，并引导到合适操作流程。
帮助你将 Power Automate 云端流程接入 Power Pages 站点并生成调用代码
审计 Power Pages 站点表权限配置，输出分级安全报告并给出修复建议。
帮助开发者在认证、输入处理、密钥和敏感功能开发中进行系统安全审查
检查并配置 Power Pages 站点前的 WAF 防火墙，提升抗攻击与访问控制能力。
帮助用户扫描网站安全漏洞并输出风险分析与修复建议。
对网站执行规则化审计，检查无障碍、SEO、安全头与性能问题
用于架构设计与代码实现阶段的安全审查，识别威胁、漏洞与合规风险。