powerbi-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process semantic model metadata (tables, measures, and descriptions), which serves as an ingestion point for external data. To mitigate potential risks, the skill mandates a human-reviewed planning phase, requiring user approval ('pode aplicar') before any changes are executed. It also encourages the use of a read-only mode when dealing with sensitive data to prevent unauthorized alterations.
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing official developer tools and plugins, including the Microsoft '@microsoft/powerbi-modeling-mcp' package and the 'skills-for-fabric' repository. These references point to established, official software registries and project repositories.
- [SAFE]: The skill incorporates extensive safety best practices, such as requiring local backups or versioned files (PBIP/Git) before modifications, performing transactional updates, and validating logic changes with DAX queries to ensure data integrity.
Audit Metadata