paginated-report
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell, PowerShell, and Python scripts to automate report validation and interaction with the Power BI Service. These scripts invoke system tools such as
curl,jq, and theazCLI. Authentication tokens are handled securely by fetching them at runtime and piping them directly to commands to avoid exposure in process listings or logs. - [EXTERNAL_DOWNLOADS]: The documentation references report templates and real-world examples hosted on official Microsoft repositories and established community GitHub repositories. These are used strictly as reference material for authoring reports.
- [INDIRECT_PROMPT_INJECTION]: The skill processes XML-based RDL files which may be sourced from users or external repositories. The risk associated with processing untrusted data is mitigated by several structural and procedural controls.
- Ingestion points: Local RDL files and external GitHub samples referenced in
references/example-reports.md. - Boundary markers: The skill requires a structured intake interview (
references/questionnaire.md) and a manual "render and confirm" verification step before a report is considered complete. - Capability inventory: The skill can read local files, execute structural validation, upload report definitions to the Power BI API, and download rendered files.
- Sanitization: A dedicated Python script (
scripts/validate_rdl.py) performs structural checks to ensure XML integrity and schema compliance before any external upload occurs.
Audit Metadata