dashboard-layout
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze and define layouts for Power BI reports by interacting with visual.json (PBIR) files. This creates a surface for indirect prompt injection where malicious instructions could be embedded within report metadata (e.g., visual titles or object names). Evidence: 1. Ingestion point: visual.json report definition files. 2. Boundary markers: No explicit delimiters are defined in the instructions to separate untrusted report data from agent instructions. 3. Capability inventory: The skill involves calculating and applying layout coordinates to visuals. 4. Sanitization: No explicit sanitization or validation of the input JSON content is mentioned.
- [EXTERNAL_DOWNLOADS]: The skill references a web application (backgroundbuilder.officetuning.com.br) for generating dashboard backgrounds and themes. This resource is owned by the skill author (officetuning) and is central to the intended workflow. It also references official JSON schemas from Microsoft's GitHub repository.
Audit Metadata