te-cli
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides detailed instructions in
references/get-te-cli.mdandreferences/command-reference.mdto download thetebinary directly from the official Tabular Editor CDN (cdn.tabulareditor.com). This is the authoritative source for the tool and is considered a safe reference for installation and updates. - [INDIRECT_PROMPT_INJECTION]: The skill includes several scripts designed to manage
CustomInstructionsand AI schema metadata within semantic models. 1. Ingestion points: Metadata is ingested viascripts/manage-ai-metadata.csxandscripts/edit-ai-instructions-interactive.csx. 2. Boundary markers: Explicit delimiters for the instructions are absent. 3. Capability inventory: The skill uses thetebinary which has capabilities for deployment, DAX querying, and C# scripting. 4. Sanitization: Content is not sanitized beyond newline normalization. While this represents a surface for indirect prompt injection, it is the intended primary purpose of the AI metadata management functionality. - [DYNAMIC_EXECUTION]: The script
scripts/manage-ai-metadata-interactive.csxuses C# reflection (Assembly.Load,Activator.CreateInstance) to dynamically interface withSystem.Windows.Forms. This implementation allows the same script to provide a graphical user interface when run within the Tabular Editor 3 Desktop application while maintaining compatibility with the headlessteCLI environment.
Audit Metadata