svg-visuals

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references several community-maintained DAX libraries and templates, including DaxLib.SVG, PowerofBI.IBCS, and Kerry Kolosko's templates. These are established resources within the Power BI developer community and are used to extend report capabilities.
  • [INDIRECT_PROMPT_INJECTION]: The skill encourages the agent to retrieve and utilize DAX templates and UDF (User-Defined Function) definitions from external community websites and GitHub repositories, which constitutes an attack surface.
  • Ingestion points: SKILL.md and references/community-examples.md link to external sites like daxlib.org and kerrykolosko.com for code patterns and libraries.
  • Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are suggested when the agent processes content retrieved from these external sources.
  • Capability inventory: The agent has the capability to modify report files (reportExtensions.json, visual.json) using the pbir tool and modify the semantic model using the te (Tabular Editor) tool.
  • Sanitization: The skill does not specify sanitization or validation logic for the DAX expressions or SVG strings retrieved from external community templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:06 PM