The Agent Skills Directory

Command Execution: The skill generates and executes shell commands using az rest, curl, and python3 to interact with Microsoft Fabric APIs and visualize data. These operations are essential to the skill's function as a management tool and are constrained to official Microsoft endpoints.
Indirect Prompt Injection Surface: The skill processes data from external sources, such as workspace metadata and dataflow definitions. This represents a potential vulnerability surface where content retrieved from the Fabric service could influence agent behavior. However, this risk is minimal as the skill is designed for administrative tasks within a secured, authenticated environment.
Prompt Injection Analysis: Deterministic detectors may flag the skill for concealment because it instructs the agent to skip redundant reporting of intermediate preview steps. This is a benign directive intended to keep the conversation efficient and reduce token usage, not to hide activity from the user. The final state-changing actions are explicitly required to be reported.
External Dependencies: The skill suggests the use of trusted Python libraries like pyarrow, pandas, and tabulate for advanced data processing tasks. These packages are whitelisted and are not automatically installed by the skill, requiring manual user setup if needed.
Telemetry and Security: The skill mandates the inclusion of a telemetry header (x-ms-fabric-skill) in API requests for usage tracking by the service provider. No hardcoded credentials or unauthorized data exfiltration patterns were identified during the audit.

dataflows-cli