The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (get_report_usage.py, get_report_detail.py, get_report_distribution.py, performance_audit.py) that utilize subprocess.run to execute Azure CLI (az) and Fabric CLI (fab) commands. These operations are used for standard authentication (token retrieval) and to fetch report metadata, access control lists, and report definitions. The commands use list-based arguments without a shell, which prevents command injection.
[EXTERNAL_DOWNLOADS]: The scripts use the requests library to communicate with well-known Microsoft and Power BI API endpoints (e.g., api.powerbi.com, analysis.windows.net) to retrieve usage metrics and configuration data. These network operations are consistent with the skill's primary purpose and target trusted service domains.
[PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface (Category 8) by processing data from the Power BI environment.
Ingestion points: scripts/get_report_detail.py (API responses containing report/page names) and scripts/performance_audit.py (report definition JSON files like visual.json).
Boundary markers: Not explicitly used to separate untrusted data from instructions.
Capability inventory: The skill can perform network requests and shell execution via specific CLI tools.
Sanitization: The scripts do not explicitly sanitize ingested strings before they are used in generated analysis output. Given the nature of the tool as an auditor for existing enterprise assets, this is a standard risk profile for such tasks.

review-report