What is fabric-pbi-security-remediate?

Guidance for diagnosing security and access problems in Microsoft Fabric and Power BI. It covers controls such as row-level security, which limits data by user, and permissions for workspaces, reports, and data models.

Troubleshooting RLS, object- and column-level security, workspace access, service-principal login, XMLA connections, DirectLake security fallback, and blocked actions caused by Microsoft security policies.

It helps trace whether missing data or access errors come from user permissions, security filters, sensitivity labels, authentication, or governance policies.

fabric-pbi-security-remediate — Skill for Claude Code and Codex by Pat

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add PatrickGallucci/fabric-skills --skill fabric-pbi-security-remediate

Clone the repo

git clone --depth 1 https://github.com/PatrickGallucci/fabric-skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/patrickgallucci/fabric-skills/fabric-pbi-security-remediate/github.svg)](https://agentmods.dev/skills/patrickgallucci/fabric-skills/fabric-pbi-security-remediate)

Your own site

<a href="https://agentmods.dev/skills/patrickgallucci/fabric-skills/fabric-pbi-security-remediate"><img src="https://agentmods.dev/badge/skills/patrickgallucci/fabric-skills/fabric-pbi-security-remediate/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/patrickgallucci/fabric-skills/fabric-pbi-security-remediate"><img src="https://agentmods.dev/badge/skills/patrickgallucci/fabric-skills/fabric-pbi-security-remediate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 113 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,198 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00113	$0.02198
Opus 5	$0.00056	$0.01099
Sonnet 5	$0.00023	$0.00440
Haiku 4.5	$0.00011	$0.00220

Measured 12d ago against content hash ff970dda7704, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

fabric-pbi-security-remediate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/Get-PBISecurityDiagnostic.ps1, scripts/Test-PBIRowLevelSecurity.ps1), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/fabric-pbi-security-remediate/SKILL.md · 199 lines

How it starts

The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Microsoft Fabric Power BI Security remediate

Systematic diagnostic toolkit for resolving security and access control issues across the Microsoft Fabric Power BI stack. Covers workspace permissions, data-level security (RLS/OLS/CLS), sensitivity labels, service principal access, and governance policy restrictions.

When to Use This Skill

User reports "access denied" or "unauthorized" errors in Power BI reports or workspaces
Report visuals show blank data or "field cannot be found" errors
RLS filters are not applying correctly or returning unexpected data
Sensitivity labels are greyed out, blocking exports, or preventing publishing
Service principal cannot access workspaces or semantic models
DirectLake reports fall back to DirectQuery unexpectedly due to security
DLP or Purview protection policies are blocking item access
Workspace role assignments are not behaving as expected
XMLA endpoint connections fail with permission errors
Users lose access to items after policy or label changes

Prerequisites

PowerShell 7+ with MicrosoftPowerBIMgmt module
Fabric Admin or Workspace Admin role for diagnostic scripts
Power BI REST API access (interactive or service principal)
Optional: Tabular Editor for OLS/RLS inspection

Install required modules:

Install-Module -Name MicrosoftPowerBIMgmt -Scope CurrentUser -Force
Install-Module -Name Az.Accounts -Scope CurrentUser -Force

Quick Diagnostic Flowchart

User reports access issue
    │
    ├─ Can they see the workspace? ─── NO ──► Check workspace role assignment
    │                                          See: Workspace Permissions
    │
    ├─ Can they see the item? ──────── NO ──► Check item-level sharing or
    │                                          Purview/DLP policies
    │                                          See: Governance Policy Restrictions
    │
    ├─ Can they see data in visuals? ─ NO ──► Check RLS role membership
    │                                          and DAX filter expressions
    │                                          See: RLS remediate
    │
    ├─ Do visuals show "field not      YES ─► Check OLS/CLS configuration
    │   found" errors?                         See: OLS/CLS remediate
    │
    ├─ Can they export/download? ───── NO ──► Check sensitivity label encryption
    │                                          and export settings
    │                                          See: Sensitivity Labels
    │
    └─ XMLA or API errors? ────────────────► Check endpoint settings, service
                                               principal permissions, and capacity
                                               See: XMLA & API Access

Read the full file on GitHub · 199 lines

Files

What ships with it

8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 199 lines · 113 tokens per session scan A ff970dda7704

Subscribe to this mod's changes

fabric-pbi-security-remediate is a skill published in the GitHub repository PatrickGallucci/fabric-skills (16 stars, last pushed 3mo ago), licensed MIT. It adds 113 tokens to every session and 2,198 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Analytics and metrics Security claude claude-skills copilot copilot-skills fabric microsoft-fabric

issue-authoring

Draft or refine IDD-ready GitHub issues, roadmap issues, and sub-issues before the normal IDD execution loop begins. Use when a request is too large or ambiguous for one reviewable change, when work needs decomposition or dependency encoding, or when the user asks for issue drafting, roadmap planning, or…

kurone-kito/idd-skill · 71 tokens

kitty-explain

Turn source content into a humorous sketchnote-style explanation featuring photorealistic cats based on the cat images in the references folder.

microsoft/microsoft-copilot-agents-playbook · 32 tokens

routeros-command-tree

RouterOS command tree introspection via /console/inspect API. Use when: building tools that parse RouterOS commands, generating API schemas from RouterOS, working with /console/inspect, mapping CLI commands to REST verbs, traversing the RouterOS command hierarchy, or when the user mentions inspect, command tree, RAML…

tikoci/routeros-skills · 79 tokens

routeros-container

RouterOS /container subsystem for running OCI containers on MikroTik devices. Use when: enabling containers on RouterOS, setting up VETH/bridge networking for containers, managing container lifecycle via CLI or REST API, building OCI images for RouterOS, configuring container environment variables, troubleshooting…

tikoci/routeros-skills · 86 tokens

routeros-mndp

MNDP (MikroTik Neighbor Discovery Protocol) wire format, behavior, and RouterOS /ip/neighbor integration. Use when: implementing MNDP discovery, parsing MNDP packets, working with /ip/neighbor, understanding WinBox device discovery, debugging why a router doesn't appear in neighbor lists, or when the user mentions…

tikoci/routeros-skills · 88 tokens

routeros-syntax-inspection

Inspecting and validating RouterOS command/script syntax against a live device via /console/inspect (highlight, completion, syntax, child) and :parse IL. Use when: validating RouterOS commands before execution, explaining or linting RouterOS scripts, building syntax-aware tooling (LSP servers, validators, agent…

tikoci/routeros-skills · 111 tokens