add-sample-data
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- Command Execution: The skill employs the
Bashtool to run administrative commands, such asaz account show, and internal utility scripts to manage authentication and Dataverse interactions. These operations are performed within the context of the user's active environment and are necessary for the skill's primary function. - Indirect Prompt Injection Surface: The skill ingests data from local configuration manifests like
.datamodel-manifest.jsonand remote API responses to inform its sample data generation. It lacks explicit boundary markers for these external inputs when they are processed to influence record generation. The skill's capabilities include executing shell scripts for database interactions and writing results to project logs. Ingested data is typically filtered viajqto ensure payloads match the expected Dataverse schema. - Dynamic Execution: At runtime, the skill uses the
nodeengine to evaluate JavaScript snippets for extracting specific configuration values from local project files, such aspower.config.json. This dynamic execution is scoped to the resolution of environment identifiers required for correct API targeting.
Audit Metadata