fabric-sdk
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection Surface]: This skill facilitates the retrieval of data from Microsoft Fabric semantic models. Processing data from external sources introduces a potential surface for indirect prompt injection if the retrieved content contains malicious instructions intended to influence the agent.
- Ingestion points: Data enters the context via the
result.table.rowsproperty returned by thequery()method inSKILL.md. - Boundary markers: The documentation and examples do not define explicit delimiters or instructions to ignore embedded commands within the fetched data.
- Capability inventory: The
FabricClientclass documented inSKILL.mdandreferences/types.mdprovides methods to execute DAX queries and retrieve model data. - Sanitization: No specific sanitization or validation steps are provided for the row data before it is processed by the agent.
Audit Metadata