The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The daxlib.sh script fetches package manifests and TMDL (Tabular Model Definition Language) function definitions from an external GitHub repository at github.com/daxlib/daxlib and daxlib.org. These sources are not within the recognized trusted vendor list.
[REMOTE_CODE_EXECUTION]: The skill facilitates the installation of third-party DAX functions into the local Power BI model. It downloads these functions from a remote registry and applies them to the live model using a C# helper tool, effectively introducing external logic into the environment.
[COMMAND_EXECUTION]: For macOS users, the skill utilizes the prlctl exec command to execute arbitrary shell logic within a Parallels Windows VM. This allows the host-based agent to drive a guest operating system's command line.
[PRIVILEGE_ESCALATION]: Instructions in SKILL.md explicitly direct the agent to use the -ExecutionPolicy Bypass flag when executing PowerShell commands or scripts. This is a deliberate instruction to circumvent standard Windows security policies that block unsigned or local scripts.
[DYNAMIC_EXECUTION]: The daxlib.sh script invokes dotnet run on the scripts/daxlib-tom/ project, which involves compiling and executing C# code at runtime to perform model modifications.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted TMDL data fetched from external repositories, posing a risk if the remote source is compromised.
Ingestion points: TMDL files are fetched from the daxlib/daxlib GitHub repository via daxlib.sh.
Boundary markers: There are no explicit boundary markers or safety warnings provided when processing these external definitions.
Capability inventory: The skill possesses significant capabilities, including prlctl exec for VM shell access, dotnet run for local execution, and the ability to modify Power BI semantic model metadata.
Sanitization: The TmdlParser in the C# helper performs structural parsing but does not implement security sanitization of the DAX expressions contained within the downloaded files.

connect-pbid