add-sample-data

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • Command Execution: The skill employs the Bash tool to run administrative commands, such as az account show, and internal utility scripts to manage authentication and Dataverse interactions. These operations are performed within the context of the user's active environment and are necessary for the skill's primary function.
  • Indirect Prompt Injection Surface: The skill ingests data from local configuration manifests like .datamodel-manifest.json and remote API responses to inform its sample data generation. It lacks explicit boundary markers for these external inputs when they are processed to influence record generation. The skill's capabilities include executing shell scripts for database interactions and writing results to project logs. Ingested data is typically filtered via jq to ensure payloads match the expected Dataverse schema.
  • Dynamic Execution: At runtime, the skill uses the node engine to evaluate JavaScript snippets for extracting specific configuration values from local project files, such as power.config.json. This dynamic execution is scoped to the resolution of environment identifiers required for correct API targeting.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 08:02 AM