semantic-model

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run to execute official external CLI tools such as fab (Microsoft Fabric CLI), az (Azure CLI), and te (Tabular Editor CLI) for metadata retrieval and authentication.
  • Evidence: Found in scripts/get_model_info.py and scripts/get_semantic_model_ai_metadata.py.
  • Purpose: These operations are necessary for retrieving model information, security labels, and bearer tokens from the user's authenticated environment.
  • [COMMAND_EXECUTION]: Several C# scripts use reflection to access internal Tabular Editor APIs and dynamically load UI libraries for interactive editing.
  • Evidence: Assembly.Load for ScintillaNET and reflection-based access to TabularCultureHelper in scripts/edit-ai-instructions-interactive.csx and others.
  • Purpose: This enables rich text editing and management of AI metadata within the Tabular Editor environment.
  • [DATA_EXFILTRATION]: The script scripts/get_model_info.py transmits model metadata to official Microsoft Power BI endpoints for information enrichment.
  • Evidence: POST requests to *.analysis.windows.net domains to retrieve storage mode and capacity details.
  • Context: This communication targets well-known service infrastructure and is essential for the model review process.
  • [EXTERNAL_DOWNLOADS]: The Python scripts import the requests library to communicate with Microsoft service APIs.
  • Context: These connections are used to enrich the audit data with service-side metadata from official Microsoft infrastructure.
  • [PROMPT_INJECTION]: The skill processes untrusted metadata (AI instructions and schemas) from semantic models, which presents an indirect prompt injection surface.
  • Ingestion points: Metadata is extracted from service definitions via scripts/get_semantic_model_ai_metadata.py.
  • Capability Inventory: The skill has access to shell execution (fab, te) and the local file system.
  • Sanitization: Standard JSON parsing is employed, and the skill is specifically designed to audit these objects as its primary use case.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 05:49 PM
Security Audit — agent-trust-hub — semantic-model