power-bi-performance-troubleshooting
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-provided performance reports and external search results, which could potentially be used to inject instructions.
- Ingestion points: Processes user-provided DAX queries and performance symptom reports in
SKILL.md(Step 1 and Step 2); fetches external performance guidance from Microsoft Learn using themicrosoft-learn-mcp/microsoft_docs_searchtool. - Boundary markers: The diagnostic workflow in
SKILL.mddoes not specify the use of delimiters or instructions to ignore embedded commands within the analyzed data. - Capability inventory: The skill utilizes tools such as
dax_query_operationsto execute queries andmeasure_operationsto review or modify DAX expressions (listed in the 'MCP Tools' section ofSKILL.md). - Sanitization: No explicit sanitization or validation logic is defined for the ingested DAX code or documentation content before it is processed by the agent.
Audit Metadata