te-cli

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides detailed instructions in references/get-te-cli.md and references/command-reference.md to download the te binary directly from the official Tabular Editor CDN (cdn.tabulareditor.com). This is the authoritative source for the tool and is considered a safe reference for installation and updates.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes several scripts designed to manage CustomInstructions and AI schema metadata within semantic models. 1. Ingestion points: Metadata is ingested via scripts/manage-ai-metadata.csx and scripts/edit-ai-instructions-interactive.csx. 2. Boundary markers: Explicit delimiters for the instructions are absent. 3. Capability inventory: The skill uses the te binary which has capabilities for deployment, DAX querying, and C# scripting. 4. Sanitization: Content is not sanitized beyond newline normalization. While this represents a surface for indirect prompt injection, it is the intended primary purpose of the AI metadata management functionality.
  • [DYNAMIC_EXECUTION]: The script scripts/manage-ai-metadata-interactive.csx uses C# reflection (Assembly.Load, Activator.CreateInstance) to dynamically interface with System.Windows.Forms. This implementation allows the same script to provide a graphical user interface when run within the Tabular Editor 3 Desktop application while maintaining compatibility with the headless te CLI environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 07:06 PM