powerbi-campaign-roi-analyzer
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires cloning a repository from an untrusted personal GitHub account (
thanhtu150/powerbi-campaign-roi-analyzer). External code from unverified sources can contain malicious Power Query (M) scripts or configurations. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from multiple social media APIs (Facebook, LinkedIn, TikTok) and CRM systems.
- Ingestion points: Data is ingested via
Facebook.Graph,LinkedIn.Campaigns, andWeb.Contentsfor TikTok API calls. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are present for the processed data.
- Capability inventory: The skill possesses network access capabilities for data retrieval and file system access for project setup.
- Sanitization: There is no evidence of sanitization or filtering for the external campaign content or engagement data before it is processed by the agent.
Audit Metadata