Microsoft Power Bi

• Outcome: Review
• Latest audit: May 29, 2026 at 9:38 PM UTC
• Version:
  1.0.5

Overview

This appears to be a legitimate Power BI integration, but it gives an agent high-impact Power BI change and delete capability without clear built-in approval safeguards.

Install only if you trust Membrane and are comfortable granting delegated Power BI access. Use a least-privileged Power BI account or workspace where possible, and require the agent to show the exact workspace, dataset, report, user, and intended effect before any create, update, refresh, clone, delete, or proxy request.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents destructive Power BI operations such as deleting workspaces, datasets, and reports, but provides no guidance to require explicit user confirmation, scope checks, or dry-run behavior before execution. In an agent setting, this increases the risk of accidental or overly broad destructive actions against production BI assets if the agent interprets a user request incorrectly or acts with insufficient safeguards.

VirusTotal

63/63 vendors flagged this skill as clean.