eventschemaset-consumption-cli

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • Update Verification Procedure: The skill includes an instruction to verify its current version by fetching metadata from a remote GitHub repository. This is a standard maintenance task using a well-known service to ensure the skill remains up-to-date, which is considered a safe operational practice.
  • Official Vendor API Interaction: The skill performs REST API calls to Microsoft Fabric endpoints (api.fabric.microsoft.com) using az rest. These operations are aligned with the skill's intended purpose and target the author's official infrastructure, representing standard and expected behavior.
  • Indirect Prompt Injection Surface: The skill retrieves, decodes, and summarizes Event Schema Set definitions from a REST API. This process involves handling external data that could theoretically be manipulated to contain malicious instructions. While the skill employs jq for structured parsing, it does not explicitly use boundary markers when presenting the summary to the user, which is a common characteristic of integration skills.
  • Ingestion points: Event Schema Set definitions retrieved from the Fabric REST API in SKILL.md.
  • Boundary markers: None explicitly defined for the output generated from the decoded JSON.
  • Capability inventory: The skill uses az, jq, base64, and curl for API interaction and data processing.
  • Sanitization: Employs jq for structure parsing and base64 for decoding prior to summarization.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 08:06 PM
Security Audit — agent-trust-hub — eventschemaset-consumption-cli