power-bi-salespulse-dashboard
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository and download datasets from an external GitHub account (
MahbubNibir/power-bi-retail-analytics-viz) that is not identified as a trusted vendor. - [COMMAND_EXECUTION]: Installation steps require the user to execute shell commands, including
git clone,unzip, andstart, to set up and launch the dashboard application. - [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection because it processes untrusted retail transaction data from external CSV and ZIP files.
- Ingestion points: Data is ingested from
global-superstore-data.zipandsales.csvduring the initial setup and data refresh phases. - Boundary markers: No delimiters or safety instructions are used to distinguish external data from the dashboard's logic or the agent's instructions.
- Capability inventory: The skill provides code for Python network requests (
requests.post), shell command execution, and VBA macros for Excel integration. - Sanitization: The instructions do not include steps for validating or sanitizing the input data from the external source files.
Audit Metadata