create-pbi-report
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
pbircommand-line tool to perform actions such as creating reports, renaming pages, and configuring visuals. These commands operate on the local file system and interact with Power BI workspaces. - [EXTERNAL_DOWNLOADS]: The instructions direct the user to install the
pbir-clipackage from standard registries like PyPI, which is necessary for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it reads and processes metadata and data values from Power BI models to provide design recommendations.
- Ingestion points: The agent uses
pbir modelcommands inSKILL.mdto discover model fields and query specific values. - Boundary markers: There are no instructions to use delimiters or ignore embedded instructions when the agent processes the model metadata.
- Capability inventory: The skill possesses the ability to write to the file system and perform network operations via the
pbirCLI. - Sanitization: The skill does not implement sanitization or validation of the data retrieved from the Power BI model before it is processed by the agent.
Audit Metadata