power-bi-retail-analytics-salespulse360
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to clone a project repository from
https://github.com/MahbubNibir/power-bi-retail-analytics-viz.git. This external source is not a verified organization or the skill author, introducing a risk from unvetted third-party content. - [COMMAND_EXECUTION]: The setup process requires running shell commands like
git cloneandcdto fetch and manage the dashboard files on the local system. - [COMMAND_EXECUTION]: The Power Query (M) scripts include instructions to load data using absolute file paths (e.g.,
C:\Data\GlobalSuperstore.csv), which could be misused for unauthorized file system access if modified. - [PROMPT_INJECTION]: The skill is designed to ingest and process retail data from CSV files. This creates an attack surface for indirect prompt injection where malicious content in the data file could influence the agent's behavior during analysis.
- Ingestion points:
Csv.Document(File.Contents(...))references inSKILL.md. - Boundary markers: None identified in the instructional content.
- Capability inventory: Shell execution (
git clone,cd) and execution of Power BI-specific data transformation logic (DAX and M). - Sanitization: No validation or filtering of the CSV data content is implemented.
Audit Metadata