The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the agent to clone a repository from a third-party GitHub account (https://github.com/MahbubNibir/power-bi-retail-analytics-viz.git). While GitHub is a well-known service, the repository content is managed by an unverified individual user.
[REMOTE_CODE_EXECUTION]: The workflow requires downloading and opening a .pbix file from the aforementioned repository. Power BI files can contain Power Query (M) scripts or embedded visualizations that execute when the file is opened.
[COMMAND_EXECUTION]: The documentation includes shell commands for environment setup, such as git clone, tar, and unzip. It also utilizes system commands like start (Windows) and open (macOS) to launch external applications.
[DYNAMIC_EXECUTION]: The skill provides a Python script snippet for K-means clustering using pandas and scikit-learn. This code is designed to be executed by the local Python engine integrated into Power BI Desktop.
[CREDENTIALS_UNSAFE]: While the skill correctly recommends using environment variables (Environment.GetEnvironmentVariable) to manage database credentials rather than hardcoding them, the handling of these variables remains a sensitive operation.
[DATA_EXPOSURE]: The implementation of Row-Level Security (RLS) utilizes USERPRINCIPALNAME(), which accesses the identity metadata of the user viewing the report.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface through external CSV files and SQL databases.
Ingestion points: data/GlobalSuperstore.csv (via zip), SQL Server connection strings.
Boundary markers: None present in the instructions to prevent processing of malicious data records.
Capability inventory: Shell command execution, local Python script execution, and file system access.
Sanitization: Relies on standard Power Query type transformations without explicit validation for adversarial data patterns.

power-bi-retail-analytics-dashboard