enable-tables-offline
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill uses
Bashto run local Node.js scripts (such asresolve-environment.jsanddataverse-request.js) andnode -eto extract configuration values from project files. These operations are restricted to scripts within the plugin environment and are used to facilitate the automation of Dataverse metadata updates. - Data Access and Network Operations: The skill reads local project configuration files (
power.config.json,app.config.js) to identify the target environment. It then performs authenticated requests to Microsoft Dataverse APIs to query and update entity metadata. These actions are transparently documented in the workflow and are scoped to the skill's purpose of enabling offline capabilities. - Indirect Prompt Injection Surface: The skill resolves Dataverse table names from user arguments, project manifests, and source code files. While processing external data is a standard ingestion surface, the skill includes a human-in-the-loop checkpoint using
EnterPlanModeandExitPlanMode. This requires the user to review and approve the generated plan before the skill executes any state-changing PUT or POST requests.
Audit Metadata