fabric-cli-core

Warn

Audited by Runlayer on Feb 23, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
12
Flagged
12
Chunks
20
Flagged Files (12)
README.mdHIGH
78.3%

Malicious tool definition detected

## What This Skill Provides - Fabric hierarchy mental model (Tenant → Workspace → Folder → Item → OneLakeItem) - Path conventions with dot entity suffixes (e.g., `.Workspace`, `.Notebook`) - Authentication patterns (interactive, SPN, managed identity) - Hidden entity discovery (`ls -a`) - Security and sensitive data handling rules - Critical operational rules - Common item types reference ## Entry Point

SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/2] Description: --- name: fabric-cli-core description: Use Microsoft Fabric CLI (fab) to manage workspaces, semantic models, reports, notebooks, and Fabric resources. Activate when users mention fab, Fabric CLI, or need to automate Fabric operations.

references/fab-api.mdHIGH
78.3%

Malicious tool definition detected

## API Basics ```bash # Fabric API (default) fab api "<endpoint>" # Power BI API fab api -A powerbi "<endpoint>" # With query fab api "<endpoint>" -q "value[0].id" # POST with body fab api -X post "<endpoint>" -i '{"key":"value"}' ``` ## Capacities ```bash # List all capacities fab api capacities # Response includes: id, displayName, sku (F2, F64, FT1, PP3), region, state ``` **Pause capacity** (cost savings): ```bash # CAUTION: Pausing stops all workloads on that capacity # Resume is intentiona

references/notebooks.mdHIGH
78.3%

Malicious tool definition detected

## Overview Fabric notebooks are interactive documents for data engineering, data science, and analytics.

Tool: references/notebooks.md [2/2] Description: status via API WS_ID=$(fab get "Production.Workspace" -q "id") NOTEBOOK_ID=$(fab get "Production.Workspace/ETL Pipeline.Notebook" -q "id") fab api "workspaces/$WS_ID/items/$NOTEBOOK_ID/jobs/instances/<job-id>" ``` ### List Execution History ```bash # List all job runs fab job run-list "Production.Workspace/ETL Pipeline.Notebook" # List only scheduled runs fab job run-list "Production.Workspace/ETL Pipeline.Notebook" --schedule # Get latest run sta

references/querying-data.mdHIGH
78.3%

Malicious tool definition detected

Execute DAX query fab api -A powerbi "groups/$WS_ID/datasets/$MODEL_ID/executeQueries" \

references/quickstart.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/quickstart.md [1/2] Description: # Fabric CLI Quick Start Guide Real working examples using Fabric workspaces and items.

Tool: references/quickstart.md [2/2]

references/reference.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/reference.md [1/4]

Description: "Production.Workspace/Report.Report" -i "Data.Workspace/Archive.Lakehouse/Files/exports/Report.Report" ``` ### open - Open in Browser #### Syntax ```bash fab open <path> ``` #### Examples ```bash fab open "Production.Workspace" fab open "Production.Workspace/Sales.Report" ``` ### ln (mklink) - Create Shortcuts #### Syntax ```bash fab ln <source> <destination> ``` ### assign / unassign - Capacity Assignment #### Syntax ```bash fab assign <workspace> -P capacityId=<capacity-id> fab un

Tool: references/reference.md [3/4] Description: #### Examples ```bash # Disable schedule fab job run-update "Production.Workspace/Pipeline.DataPipeline" --id <schedule-id> --disable # Update frequency fab job run-update "Production.Workspace/Pipeline.DataPipeline" --id <schedule-id> --type cron --interval 5 --enable # Update with JSON fab job run-update "Production.Workspace/Pipeline.DataPipeline" --id <schedule-id> -i '{"enabled": false}' ``` ## Table Commands ### table schema - View Table Sch

**Filter with JMESPath `-q`** - Reduce response size 4.

references/reports.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/reports.md Description: # Report Operations ## Get Report Info ```bash # Check exists fab exists "ws.Workspace/Report.Report" # Get properties fab get "ws.Workspace/Report.Report" # Get ID fab get "ws.Workspace/Report.Report" -q "id" ``` ## Get Report Definition ```bash # Full definition fab get "ws.Workspace/Report.Report" -q "definition" # Save to file fab get "ws.Workspace/Report.Report" -q "definition" -o /tmp/report-def.json # Specific parts fab get "ws.Workspace/Report.Rep

references/semantic-models.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/semantic-models.md [1/2] Description: # Semantic Model Operations Comprehensive guide for working with semantic models (Power BI datasets) using the Fabric CLI.

Tool: references/semantic-models.md [2/2] Description: Description ```bash fab set "Production.Workspace/Sales.SemanticModel" -q description -i "Primary sales analytics semantic model for production reporting" ``` ## Advanced Patterns ### Extract All Measures ```bash # Get all table definitions containing measures fab get "Production.Workspace/Sales.SemanticModel" -q "definition.parts[?contains(path, '/tables/')]" -o /tmp/tables.json # Process with script to extract measures python3 << 'EOF' imp

references/workspaces.mdHIGH
78.3%

Malicious tool definition detected

## Overview Workspaces are containers for Fabric items and provide collaboration and security boundaries.

Tool: references/workspaces.md [2/2] Description: # List users with access fab api -A powerbi "groups/$WS_ID/users" ``` ### Add User to Workspace ```bash WS_ID=$(fab get "Production.Workspace" -q "id") # Add user as member fab api -A powerbi "groups/$WS_ID/users" -X post -i '{ "emailAddress": "user@company.com", "groupUserAccessRight": "Member" }' # Access levels: Admin, Member, Contributor, Viewer ``` ### Remove User from Workspace ```bash WS_ID=$(fab get "Production.Workspace" -q "id") # Remov

scripts/health_check.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/health_check.py Description: #!/usr/bin/env python3 """ health_check.py - Verify CLI installation, auth status, and connectivity This script performs comprehensive health checks for the Fabric CLI environment: - Verifies fab CLI is installed and accessible - Checks authentication status - Validates workspace connectivity - Optionally verifies specific workspace access Usage: python health_check.py [--workspace WS] [--json] Exit codes: 0 - All checks passed (healthy) 1 - One or more

references/create-workspaces.mdMEDIUM
60.8%

Tool passed security scan

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
12
Files Flagged
12
Chunks Analyzed
20
Analyzed
Feb 23, 2026, 05:16 PM
Security Audit — runlayer — fabric-cli-core