The Agent Skills Directory

Dependency Management: The skill utilizes official packages from the @microsoft scope (e.g., @microsoft/powerbi-report-authoring-cli, @microsoft/powerbi-modeling-mcp) and standard development tools like az CLI, jq, and git. These originate from trusted sources and are used for their intended administrative and development purposes.
Data Handling & Privacy: Telemetry is explicitly declared for tracking skill usage via custom headers (x-ms-fabric-skill), which is a transparent practice for enterprise tools. The skill provides guidance on using az login for authentication, ensuring that security tokens are handled by the user's local Azure environment rather than being hardcoded or exfiltrated.
Indirect Prompt Injection Surface: As a developer tool, the skill naturally ingests data from semantic models and report definitions. While this technically creates a surface for indirect prompt injection (Category 8), the skill is authored by a trusted vendor and provides structured workflows that minimize risk. The capabilities are aligned with the primary purpose of report authoring and management.
Command Execution: The use of shell commands is well-documented and restricted to established utilities (az, jq, base64, git) for processing structured Power BI definition files. No arbitrary or obfuscated command execution was detected.
Resource Validation: The skill includes rigorous instructions for validating Power BI Report (PBIR) JSON against official schemas and performing visual verification via Power BI Desktop, ensuring the integrity of the authored content.

powerbi-report-cli