add-pen-input

add-pen-input is a skill for Claude Code from microsoft/power-platform-skills. It costs 39 tokens per session (1,680 once invoked), scanned A, original, MIT.

An internal implementation helper for adding pen, signature, drawing, or handwriting capture to a Power Apps mobile app. It uses Microsoft's native pen-input package through a React Native wrapper.

In plain words
What is it for?
It generates or verifies the pen-input wrapper and documents how to call its native API. It does not install the package or change native project configuration.
Why use it?
It gives the mobile app a defined path for capturing ink without using an unrelated desktop or web integration route. It also checks that the app and required package already exist.

Skill for Claude Code ✓ vendor

Written for Claude Code: allowed-tools in frontmatter. Also seen: model in frontmatter; names the AskUserQuestion tool.

Part of the mobile-app plugin — 23 skills, 5 agents shipped together

Good fit It generates or verifies the pen-input wrapper and documents how to call its native API. It does not install the package or change native project configuration.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/microsoft/power-platform-skills/add-pen-input
About the project

microsoft/power-platform-skills is a plugin marketplace containing reusable skills, agents, and commands for developing with Microsoft Power Platform. Developers use it to build and deploy Power Pages sites, model-driven Power Apps, and related solutions through Claude Code or GitHub Copilot. The catalogue entries are the marketplace's included skills, agents, plugins, and other agent components.

microsoft/power-platform-skills · 836 stars · on GitHub · aka.ms

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add microsoft/power-platform-skills --skill add-pen-input
Clone the repo
git clone --depth 1 https://github.com/microsoft/power-platform-skills

Made for: Claude Code.

Or install mobile-app, the plugin that ships this one along with the rest of its 23 skills, 5 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for add-pen-input

README.md
[![agentmods](https://agentmods.dev/badge/skills/microsoft/power-platform-skills/add-pen-input.svg)](https://agentmods.dev/skills/microsoft/power-platform-skills/add-pen-input)
Your own site
<a href="https://agentmods.dev/skills/microsoft/power-platform-skills/add-pen-input"><img src="https://agentmods.dev/badge/skills/microsoft/power-platform-skills/add-pen-input.svg" alt="Measured on agentmods" height="20"></a>
Per session 39 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,680 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Excessive Agency · line 7
    Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
    Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
  • medium MCP Rug Pull · line 34
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 161
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00039 $0.01680
Opus 5 $0.00019 $0.00840
Sonnet 5 $0.00008 $0.00336
Haiku 4.5 $0.00004 $0.00168

Measured 4d ago against content hash c1534930a705, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

add-pen-input scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/mobile-apps/skills/add-native/add-pen-input/SKILL.md · 200 lines

How it starts

The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.

📋 Shared instructions: shared-instructions.md — read first.

Add Pen Input

Internal helper. Users should invoke /add-native pen-input, /add-native signature, or /add-native @microsoft/power-apps-native-pen-input; /add-native routes here after resolving the capability.

Generate or verify the native pen input wrapper and show how to call its native React Native API. Do not use the HostingSDK / PCF path from the package README; that is for a different use case.

Steps

1. Verify app

test -f app.config.js && test -f power.config.json && test -f package.json && test -d src

If this fails, tell the user to run /create-mobile-app first and STOP.

2. Verify package is already present

node -e "const p=require('./package.json'); const m='@microsoft/power-apps-native-pen-input'; if (!p.dependencies?.[m]) { console.error('MISSING: ' + m + ' is not in package.json. The template/app must already ship this native extension. This skill will not install it or edit native config.'); process.exit(1); } console.log('OK: pen input package present');"

If the check fails, STOP. Do not run npm install, npx expo install, pod install, or edit app.config.js. This package contains native iOS/Android code and must already be part of the app's native build.

3. Write or verify src/native/penInput.ts

Create src/native/penInput.ts if it does not exist. If it already exists, inspect it and patch only if cancellation is treated as an error or the wrapper can throw.

The wrapper MUST:

  • Return a discriminated union and never throw.
  • Return { ok: false, reason: 'USER_CANCELLED' } for user cancellation; this is a non-error path.
  • Return NATIVE_MODULE_MISSING when the extension is installed in JS but unavailable in the native build.
  • Return a PNG data URI (data:image/png;base64,...) on success.
// src/native/penInput.ts
import {
  PenInputNative,
  PenInputStatus,
  PenInputErrorCode,
} from '@microsoft/power-apps-native-pen-input';

export type PenInputResult =
  | { ok: true; dataUri: string }
  | { ok: false; reason: 'USER_CANCELLED' | 'NATIVE_MODULE_MISSING' | 'CAPTURE_FAILED'; message?: string };

export async function captureSignature(options?: {
  backgroundColor?: string;
  strokeColor?: string;
  strokeWidth?: number;
}): Promise<PenInputResult> {
  if (!PenInputNative?.capturePenInput) {
    return { ok: false, reason: 'NATIVE_MODULE_MISSING', message: 'Pen input module is not available in this build.' };
  }

  try {
    const result = await PenInputNative.capturePenInput({
      backgroundColor: '#ffffff',
      strokeColor: '#0078d4',
      strokeWidth: 2,
      ...options,
    });

    if (result.status === PenInputStatus.Ok && result.result) {
      return { ok: true, dataUri: result.result };
    }

    if (result.error === PenInputErrorCode.UserCancelled) {
      return { ok: false, reason: 'USER_CANCELLED' };
    }

    return { ok: false, reason: 'CAPTURE_FAILED', message: result.error };
  } catch (error: any) {
    return { ok: false, reason: 'CAPTURE_FAILED', message: error?.message ?? String(error) };
  }
}

export function stripDataUriPrefix(dataUri: string): string {
  return dataUri.replace(/^data:image\/png;base64,/, '');
}

Read the full file on GitHub · 200 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago Changed c1534930a705
  2. 8d ago First seen · 200 lines · 39 tokens per session scan A 34a9062fc0dc

Subscribe to this mod's changes

add-pen-input is a skill published in the GitHub repository microsoft/power-platform-skills (836 stars, last pushed today), licensed MIT. It adds 39 tokens to every session and 1,680 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

canvas-apps-ui-gen

Generates paste-ready Power Apps Canvas App YAML. Invoke when the user wants to replicate a UI mockup, improve an existing Canvas app screen, or build a new screen from a text description. Also invoke when the user asks to "improve", "redesign", or "generate YAML" for a Canvas app screen.

ToluVictor/canvas-apps-tools · 71 tokens

vertical-fintech-mobile

Domain-knowledge pack for money on a phone — wallets, payments, custody and signing, transaction lifecycle, KYC/AML gates, and offline reconciliation. The rules that separate a payments app from a CRUD app with a currency symbol: a balance is a claim about a server, an idempotency key must outlive the process that…

avelikiy/great_cto · 119 tokens

validate-mobile

Run a Maestro flow on an explicitly selected iOS or Android device and report behavioral evidence.

johnkozaris/jko-claude-plugins · 20 tokens

fec-pwa-implementation

A guide for adding Progressive Web App features to a website. A Progressive Web App, or PWA, is a website that can be installed like an app and can offer limited offline use through a web app manifest and a service worker.

bovinphang/frontend-craft · 87 tokens

swiftui-expert

This skill should be used when SwiftUI work requires judgment about Observation and state ownership, view identity or lifecycle, navigation, app-target concurrency, persistence, Apple-platform behavior, accessibility, performance, or architecture. Trigger on "review this SwiftUI screen", "why isn't this view…

johnkozaris/jko-claude-plugins · 133 tokens

eng-unity-mobile-optimization

Mobile-specific Unity optimization patterns for memory, battery, thermal, and performance.

IdoCohen560/claude-unity-game-studio · 22 tokens