powerbi-modeling
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows secure design principles for AI tools by prioritizing local execution and requiring explicit user authorization for external data retrieval or model inference via the SandBase API. The workflow includes validation steps (Quality Gates) to verify outputs and ensures reproducibility by pinning library versions and seeds.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources and local files, which presents a standard indirect prompt injection surface common to data-processing agents. However, the instructions mitigate this by requiring acceptance checks, source comparison, and manual validation of deliverables rather than inferring success from file creation alone. Mandatory Evidence Chain:
- Ingestion points: Local user files, runtime environments, and external data sources via
sandbase_run(SKILL.md, Workflow Step 1). - Boundary markers: Explicit markers are absent, but the workflow requires restating constraints and acceptance checks (SKILL.md, Workflow Step 2).
- Capability inventory: Power BI model production and artifact generation.
- Sanitization: Not explicitly defined, though validation against baselines is required (SKILL.md, Quality Gates).
Audit Metadata