Skills
skills/data-goblin/power-bi-agentic-development/powerbi-custom-visuals/Gen Agent Trust Hub

powerbi-custom-visuals

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the powerbi-visuals-tools package from the official npm registry. This is a well-known development tool provided for the Power BI ecosystem.
  • [COMMAND_EXECUTION]: Instructs the agent to execute CLI commands such as pbiviz new, pbiviz start, and pbiviz package to manage the lifecycle of custom visual projects.
  • [REMOTE_CODE_EXECUTION]: Employs npx -y to run the pbiviz tools and MCP server, which involves dynamic execution of code retrieved from the npm registry.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files which could contain untrusted data.
  • Ingestion points: Reads metadata and configuration from pbiviz.json, capabilities.json, and package.json (referenced in SKILL.md and references/pbiviz-toolchain.md).
  • Boundary markers: None explicitly defined in the prompt instructions for data interpolation.
  • Capability inventory: Includes shell command execution via the pbiviz CLI and npx (referenced in SKILL.md).
  • Sanitization: The skill recommends using eslint-plugin-powerbi-visuals, pbiviz package --certification-audit, and the check_vulnerabilities MCP tool to scan for risky patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 10:01 AM
Security Audit — agent-trust-hub — powerbi-custom-visuals