revenue-cloud-pricing-apis
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data through CLI parameters that are interpolated into API request URLs.
- Ingestion points: The
--paramand--queryflags inscripts/call-pricing-apis.shaccept arbitrary strings that are used to build URL paths and query strings. - Boundary markers: None are present to distinguish between trusted templates and untrusted user input during URL construction.
- Capability inventory: The script uses
curlto perform network operations against Salesforce instances. - Sanitization: The script uses bash arrays to prevent shell injection, but does not sanitize the content of the parameters before including them in the URL.
- [COMMAND_EXECUTION]: The script
scripts/call-pricing-apis.shexecutes several system utilities includingcurl,jq,awk, and the Salesforce CLI (sf). This is consistent with the skill's intended purpose of interacting with cloud APIs via a command-line interface.
Audit Metadata