executing-spark
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto invoke the Azure CLI (az) for token retrieval and thefabCLI for workspace metadata. These are standard methods for authenticating and interacting with Microsoft Fabric resources. - [REMOTE_CODE_EXECUTION]: The primary purpose of the skill is to orchestrate the execution of PySpark and Python code on remote Fabric Spark clusters via the Livy API. This behavior is documented, intended, and directed at managed cloud compute.
- [DATA_EXFILTRATION]: Communication is restricted to official Microsoft Fabric API endpoints (
api.fabric.microsoft.com). Tokens and code are transmitted only to these authorized services, representing legitimate operation rather than malicious exfiltration. - [EXTERNAL_DOWNLOADS]: All external links and documentation references point to trusted domains, specifically
learn.microsoft.comand Microsoft's official GitHub repositories. - [SAFE]: The skill follows security best practices by recommending that tokens be passed directly to APIs rather than logged, and it uses standard system tools for its operations without any signs of obfuscation or persistence.
Audit Metadata