The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its ability to ingest untrusted data from the Fabric environment and its possession of powerful capabilities.
Ingestion points: The script scripts/get_semantic_model_ai_metadata.py retrieves and parses customInstructions and AI schema metadata directly from semantic model definitions. scripts/download_workspace.py and other export-related commands read full item definitions (TMDL, PBIR, and JSON) into the agent's context.
Boundary markers: Absent. External content from item definitions is parsed and presented to the agent without explicit delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has extensive shell command capabilities via subprocess.run (executing fab, az, sqlcmd, and duckdb), network access to Microsoft cloud APIs via urllib and requests, and local file write permissions through download_workspace.py and execute_dax.py.
Sanitization: Absent. Metadata and item definitions are parsed from external JSON/TMDL sources and used directly in the workflow without filtering.
[COMMAND_EXECUTION]: The skill relies on multiple Python scripts that use subprocess.run to execute shell commands. This is the intended primary purpose of the skill.
Evidence: scripts/query_sql_endpoint.py invokes sqlcmd, scripts/query_lakehouse_duckdb.py invokes duckdb, and scripts/deploy_notebook.py invokes both az and fab CLIs.
Risk mitigation: All subprocess calls use the list-based argument format rather than shell=True, which prevents standard shell injection vulnerabilities from user-supplied inputs like workspace names or queries.

fabric-cli