eventschemaset-consumption-cli
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- Update Verification Procedure: The skill includes an instruction to verify its current version by fetching metadata from a remote GitHub repository. This is a standard maintenance task using a well-known service to ensure the skill remains up-to-date, which is considered a safe operational practice.
- Official Vendor API Interaction: The skill performs REST API calls to Microsoft Fabric endpoints (
api.fabric.microsoft.com) usingaz rest. These operations are aligned with the skill's intended purpose and target the author's official infrastructure, representing standard and expected behavior. - Indirect Prompt Injection Surface: The skill retrieves, decodes, and summarizes Event Schema Set definitions from a REST API. This process involves handling external data that could theoretically be manipulated to contain malicious instructions. While the skill employs
jqfor structured parsing, it does not explicitly use boundary markers when presenting the summary to the user, which is a common characteristic of integration skills. - Ingestion points: Event Schema Set definitions retrieved from the Fabric REST API in
SKILL.md. - Boundary markers: None explicitly defined for the output generated from the decoded JSON.
- Capability inventory: The skill uses
az,jq,base64, andcurlfor API interaction and data processing. - Sanitization: Employs
jqfor structure parsing andbase64for decoding prior to summarization.
Audit Metadata