powerbi-authoring-cli

Pass

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [Command Execution]: The skill relies on the az CLI and az rest commands to interact with Fabric and Power BI services. While this is the primary mechanism for its administrative tasks, executing shell commands with dynamically resolved parameters (such as workspace and model IDs) is a pattern that requires careful management of input data.
  • [Indirect Prompt Injection Surface]: The skill includes workflows for downloading, editing, and uploading Tabular Model Definition Language (TMDL) files. Since these files are ingested from external API sources and processed by the agent, they represent a potential surface where embedded content could influence the agent's behavior. The skill lacks explicit boundary markers or sanitization steps for this ingested content.
  • [Handling of Temporary Data]: Administrative operations, such as creating or updating model definitions, involve writing JSON payloads to the /tmp directory. This is standard practice for CLI tools but serves as a reminder to ensure that temporary files containing potentially sensitive configuration metadata are appropriately managed.
  • [External Resource References]: The skill references official Microsoft documentation and API endpoints (e.g., api.fabric.microsoft.com, api.powerbi.com). These references are consistent with the skill's purpose as a management tool for Microsoft services.
Audit Metadata
Risk Level
SAFE
Analyzed
May 7, 2026, 08:15 PM