svg-visuals
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several community-maintained DAX libraries and templates, including DaxLib.SVG, PowerofBI.IBCS, and Kerry Kolosko's templates. These are established resources within the Power BI developer community and are used to extend report capabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill encourages the agent to retrieve and utilize DAX templates and UDF (User-Defined Function) definitions from external community websites and GitHub repositories, which constitutes an attack surface.
- Ingestion points:
SKILL.mdandreferences/community-examples.mdlink to external sites likedaxlib.organdkerrykolosko.comfor code patterns and libraries. - Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are suggested when the agent processes content retrieved from these external sources.
- Capability inventory: The agent has the capability to modify report files (
reportExtensions.json,visual.json) using thepbirtool and modify the semantic model using thete(Tabular Editor) tool. - Sanitization: The skill does not specify sanitization or validation logic for the DAX expressions or SVG strings retrieved from external community templates.
Audit Metadata