v1.0.5

Microsoft Power Bi

SuspiciousClawScan verdict for this skill. Analyzed Apr 30, 2026, 5:16 PM.

Analysis

This Power BI skill appears purpose-aligned, but it asks the agent to install an unpinned global CLI and use OAuth-backed Membrane access capable of changing or deleting shared Power BI assets without clear approval guardrails.

GuidanceInstall only if you trust Membrane and the npm CLI package. Prefer a least-privileged Power BI account, pin or isolate the CLI install, verify all OAuth and UI URLs, require explicit confirmation before any create/update/delete/refresh/user-management action, and revoke the Membrane connection when finished.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`clientAction.agentInstructions` (optional) — instructions for the AI agent on how to proceed programmatically.

The skill tells the agent to use instructions returned by a remote connection flow, but it does not define limits to prevent those instructions from overriding the user's original Power BI task.

User impactA service-provided instruction could steer the agent into actions the user did not ask for.

RecommendationTreat remote `agentInstructions` as untrusted data; follow them only when they match the user's explicit request and require confirmation for new goals or high-impact actions.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

SKILL.md

`Update Workspace | update-workspace | Updates a specified workspace.` ... `Delete Workspace | delete-workspace | Deletes the specified workspace.` ... `Delete Dataset | delete-dataset | Deletes the specified dataset.`

The skill exposes high-impact Power BI mutation and deletion actions, but the visible instructions do not include explicit per-action approval, dry-run, scope, or rollback requirements.

User impactA mistaken or overbroad agent action could alter or delete important Power BI workspaces, datasets, or reports.

RecommendationUse read-only actions by default and require explicit user confirmation with exact workspace, dataset, or report IDs before create, update, refresh, clone, delete, or permission-changing operations.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`npm install -g @membranehq/cli@latest` ... `If no app is found, one is created and a connector is built automatically.`

The skill depends on an unpinned global npm package and an automatically built connector that is not included in the provided artifacts, creating a provenance and change-control gap.

User impactFuture CLI or connector changes could alter what code runs or what actions are available after the user installs the skill.

RecommendationPin the CLI to a reviewed version, verify the package and repository, and avoid automatic connector creation unless the user explicitly approves it.

Unexpected Code Execution

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`npm install -g @membranehq/cli@latest` and `npx @membranehq/cli connection get <id> --wait --json`

Although this is presented as an instruction-only skill, the runtime instructions execute npm/npx-managed code, including a global package install with an unpinned latest version.

User impactInstalling or running the CLI can execute code on the user's machine and modify the local environment.

RecommendationRun the CLI in an isolated environment, pin and review the package version, and avoid global installation unless the user trusts the publisher.

Cascading Failures

SeverityHighConfidenceHighStatusConcern

SKILL.md

`Power BI ... visualizing and sharing data insights` ... `List Workspace Users` ... `Delete Workspace | delete-workspace | Deletes the specified workspace.`

Power BI workspaces and reports are shared organizational assets, and the skill includes destructive workspace actions without visible containment or staged confirmation requirements.

User impactOne incorrect deletion or update could disrupt reports, dashboards, datasets, or access for multiple users.

RecommendationRestrict use to test or explicitly approved workspaces, require confirmations for destructive actions, and ensure backups or recovery procedures exist.

Human-Agent Trust Exploitation

SeverityLowConfidenceMediumStatusNote

SKILL.md

`Membrane handles authentication and credentials refresh automatically — so you can focus on the integration logic rather than auth plumbing.`

This convenience framing is purpose-aligned, but users should notice that automatic credential refresh means ongoing delegated access, not just a one-time login.

User impactA user may underestimate the persistence and sensitivity of the access being granted.

RecommendationReview the account being connected, understand how credential refresh works, and revoke the connection when it is no longer needed.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

`membrane login --tenant --clientName=<agentType>` ... `The user completes authentication in the browser. The output contains the new connection id.`

The skill requires delegated OAuth-style authentication through Membrane for tenant-connected Power BI access, but it does not clearly state least-privilege scopes, tenant boundaries, revocation steps, or approval requirements for privileged operations.

User impactThe agent may be able to act with the user's Power BI permissions, including access to shared organizational resources.

RecommendationAuthenticate with a least-privileged account, review the OAuth consent screen and scopes, limit the connection to specific workspaces when possible, and revoke the connection after use.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusConcern

SKILL.md

`Membrane handles authentication and credentials refresh automatically` ... `clientAction.uiUrl` ... `Show this to the user when present.`

The skill routes authentication and follow-up actions through a third-party Membrane flow that can provide URLs and instructions, but it does not define origin validation, data-handling boundaries, or credential-storage expectations.

User impactThe user may expose Power BI credentials or data through a gateway flow whose boundaries are not fully described in the skill instructions.

RecommendationVerify all login and action URLs, review OAuth scopes and Membrane privacy/security terms, and avoid entering credentials into unexpected pages.