$ loading_
Run security scans on deployed Power Pages sites and summarize risks clearly.
Copy the install command and let the AI configure it · recommended for beginners
Please install the "scan-site" skill from askskill: 1. Download https://raw.githubusercontent.com/microsoft/power-platform-skills/main/plugins/power-pages/skills/scan-site/SKILL.md 2. Save it as ~/.claude/skills/scan-site/SKILL.md 3. Reload skills and tell me it's ready
Scan this published Power Pages site for security vulnerabilities and summarize the findings by severity.
A site security scan result with a plain-language summary of high, medium, and low severity issues.
Fetch the latest security scan report for this Power Pages site and tell me which issues need attention first.
The latest report contents plus a concise list of the highest-priority security issues.
I want to know whether my live site is safe. Run a security check on its public surface and give me an easy-to-understand conclusion.
A vulnerability check of the live public surface and a plain-language statement of overall site safety.
Developers or DevOps teams can use it after publishing a Power Pages site to scan the live public surface and quickly confirm whether high-risk vulnerabilities are exposed. It is for production security auditing, not local source code scanning.
When a team wants to understand the current risk state of a site, it can fetch the latest scan report and review issue severity levels. This helps prioritize what to fix first.
For larger sites with many pages, scans may take a long time. This skill can be used to start a scan and poll its status until results are ready to summarize.
The README explains how to run a security scan against a deployed Power Pages site, retrieve the latest report, and present findings in plain language. It covers prerequisites, resolving the correct site identity, checking whether a scan is already running, starting and polling a scan, fetching reports, and handling follow-up actions. It also notes that scans target the live public surface, can take a long time, and are limited to one active scan per site.
Plugin check: Run
node "${CLAUDE_PLUGIN_ROOT}/scripts/check-version.js"— if it outputs a message, show it to the user before proceeding.
Run a security scan on a deployed Power Pages site, fetch the latest scan report, and surface findings in a plain-language summary. The scan runs server-side; duration depends on site size — small sites finish in minutes, large sites can take hours.
This skill scans the live deployed site, not local source code.
Initial request: $ARGUMENTS
.powerpages-site/website.yml stores the website record id, not the portal id. Every script takes --portalId. Resolve once via website.js --websiteId during prerequisites.null from the resolver means the site is not deployed, or the authenticated profile points at a different environment.--timeoutMinutes for large sites.Z003 — start-deep-scan.js reports it as { "status": "already-running" } (exit 0).get-latest-report.js returns { "status": "empty" }.Create tasks in four groups. Mark each in_progress when starting, completed when done.
| Group | When to create | Tasks |
|---|---|---|
| 1 | At start | Check prerequisites |
| 2 | After prerequisites pass | Check scan state · Choose an action (skip in review mode) |
| 3 | After user confirms an action (or in review mode) | Run the scan (skip only if the user chose to view latest results in interactive mode) · Fetch and summarize (always) |
| 4 | After fetch and summarize | Walk through follow-ups (only if the report contains issues AND not in review mode) |
Use Glob to find **/powerpages.config.json. If $ARGUMENTS contains --review <out-dir>, remember the output directory — Step 3 (choose an action) is skipped, Step 4 (run scan) executes automatically (start a fresh scan or attach to a running one), Step 5 writes JSON only, and Step 6 (follow-ups) is skipped.
Read .powerpages-site/website.yml → extract id field → that is <WEBSITE_ID>.
If missing, the site has not been deployed. Tell the user and recommend /deploy-site. Stop. Do not resolve by name or URL.
Resolve to portalId:
node "${CLAUDE_PLUGIN_ROOT}/scripts/website.js" --websiteId "<WEBSITE_ID>"
Capture Id (portalId), Type, Name, WebsiteUrl. If exit code 2 → sign-in required (pac auth create or az login). If null → site not found in this environment. Stop in either case.
node "${CLAUDE_PLUGIN_ROOT}/skills/scan-site/scripts/poll-deep-scan.js" --portalId "<PORTAL_ID>" --once
--once does a single status check, exits 0, and prints:
{ "status": "ongoing" } → a scan is currently running.{ "status": "idle" } → no scan running.…
It scans the live public surface of a deployed Power Pages site, not local source code. The docs explicitly state that it targets the live deployed site.
Scan duration depends on site size. Small sites may finish in minutes, while large sites can take hours.
No. The docs say only one scan per site can run at a time; if a scan is already in progress, starting another returns an already-running status.
Set up Power Platform Pipelines for automated Power Pages deployments.
Review and fix Power Pages security headers, CSP, CORS, cookies, and embedding settings.
Run an end-to-end Power Pages security review with a consolidated HTML report.
Test deployed Power Pages sites with browsing, crawling, and API verification.
Add a data source or connector to a Power Apps code app.
Integrate Power Automate cloud flows into Power Pages with generated metadata and code.
Detect scam signals in transactions and job posts with risk scores.
Check website scans, findings, evidence, and recent domain risk signals.
Scan Claude Code configs for vulnerabilities, misconfigurations, and prompt injection risks.
Scan MCP servers for runtime, static, config, dependency, and compliance risks.
Scan website legal documents for missing or outdated compliance clauses.
Run rule-based audits for accessibility, SEO, security headers, and performance.