Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add PatrickGallucci/fabric-skills --skill fabric-lakehouse-access-controlgit clone --depth 1 https://github.com/PatrickGallucci/fabric-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/patrickgallucci/fabric-skills/fabric-lakehouse-access-control)<a href="https://agentmods.dev/skills/patrickgallucci/fabric-skills/fabric-lakehouse-access-control"><img src="https://agentmods.dev/badge/skills/patrickgallucci/fabric-skills/fabric-lakehouse-access-control/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/patrickgallucci/fabric-skills/fabric-lakehouse-access-control"><img src="https://agentmods.dev/badge/skills/patrickgallucci/fabric-skills/fabric-lakehouse-access-control.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.01598 |
| Opus 5 | $0.00054 | $0.00799 |
| Sonnet 5 | $0.00022 | $0.00320 |
| Haiku 4.5 | $0.00011 | $0.00160 |
Grade A, and why
fabric-lakehouse-access-control scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Microsoft Fabric Lakehouse Access Control remediate
Diagnose and resolve access control issues across all security layers of Microsoft Fabric Lakehouse, including workspace roles, item permissions, OneLake security data access roles, SQL analytics endpoint granular permissions, and Direct Lake semantic model security integration.
When to Use This Skill
- User cannot access lakehouse data or sees "permission denied" errors
- Queries return empty results or missing rows/columns unexpectedly
- OneLake security roles not applying or taking too long to propagate
- SQL analytics endpoint permissions not restricting access as expected
- Direct Lake semantic model returns errors after enabling OneLake security
- Shortcut data is inaccessible or returns 404 errors
- DefaultReader role conflicts with custom data access roles
- Deployment pipeline or git integration issues with data access roles
- Users see data they should not have access to (over-provisioned)
- Row-level or column-level security not filtering correctly
Prerequisites
- Microsoft Fabric workspace with capacity or trial license
- Admin, Member, or Contributor workspace role for managing security
- Familiarity with T-SQL for SQL analytics endpoint security
- PowerShell 7+ for running diagnostic scripts
Fabric Lakehouse Security Layers
Fabric Lakehouse enforces security through multiple overlapping layers. Understanding the evaluation order is critical for remediate.
Layer 1 - Workspace Roles control coarse access to all items in a workspace.
| Role | Workspace Access | OneLake Read/Write | Manage Security |
|---|---|---|---|
| Admin | Full | Yes | Yes |
| Member | Full | Yes | Yes |
| Contributor | Full | Yes | No |
| Viewer | See items only | No (unless granted) | No |
Layer 2 - Item Permissions grant access to a single lakehouse without a workspace role. Key permissions: Read (see item), ReadAll (read all OneLake data), Reshare, Write.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- LICENSE.txt 11 KB
- references/direct-lake-security-reference.md 5.5 KB
- references/onelake-security-reference.md 7.3 KB
- references/sql-endpoint-security-reference.md 6.6 KB
- references/workflow-diagnostics.md 10 KB
- scripts/Audit-SqlEndpointPermissions.ps1 6.8 KB runs code
- scripts/Test-LakehouseAccessControl.ps1 9.8 KB runs code
- templates/Validate-RowLevelSecurity.sql 5.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 101 lines · 108 tokens per session scan A 153103e9af8b
fabric-lakehouse-access-control is a skill published in the GitHub repository PatrickGallucci/fabric-skills (16 stars, last pushed 3mo ago), licensed MIT. It adds 108 tokens to every session and 1,598 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
issue-authoring
Draft or refine IDD-ready GitHub issues, roadmap issues, and sub-issues before the normal IDD execution loop begins. Use when a request is too large or ambiguous for one reviewable change, when work needs decomposition or dependency encoding, or when the user asks for issue drafting, roadmap planning, or…
kitty-explain
Turn source content into a humorous sketchnote-style explanation featuring photorealistic cats based on the cat images in the references folder.
routeros-command-tree
RouterOS command tree introspection via /console/inspect API. Use when: building tools that parse RouterOS commands, generating API schemas from RouterOS, working with /console/inspect, mapping CLI commands to REST verbs, traversing the RouterOS command hierarchy, or when the user mentions inspect, command tree, RAML…
routeros-container
RouterOS /container subsystem for running OCI containers on MikroTik devices. Use when: enabling containers on RouterOS, setting up VETH/bridge networking for containers, managing container lifecycle via CLI or REST API, building OCI images for RouterOS, configuring container environment variables, troubleshooting…
routeros-mndp
MNDP (MikroTik Neighbor Discovery Protocol) wire format, behavior, and RouterOS /ip/neighbor integration. Use when: implementing MNDP discovery, parsing MNDP packets, working with /ip/neighbor, understanding WinBox device discovery, debugging why a router doesn't appear in neighbor lists, or when the user mentions…
routeros-syntax-inspection
Inspecting and validating RouterOS command/script syntax against a live device via /console/inspect (highlight, completion, syntax, child) and :parse IL. Use when: validating RouterOS commands before execution, explaining or linting RouterOS scripts, building syntax-aware tooling (LSP servers, validators, agent…