sf-agentforce
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building autonomous agents that ingest untrusted user input from messaging channels, Slack, and programmatic APIs.\n
- Ingestion points: Data enters the agent context via user utterances through channels like Slack, SMS, and Embedded Service deployments, as described in the Channel Configuration section of SKILL.md.\n
- Boundary markers: The documentation recommends using explicit scope boundaries (inScope and outOfScope) in GenAiTopic metadata and focused instructions to define agent behavior and prevent routing ambiguity.\n
- Capability inventory: Agents are capable of invoking Apex code, Flows, and External Services (API calls), representing a significant capability surface if user input is not properly handled.\n
- Sanitization: The skill identifies and documents the Einstein Trust Layer as the primary sanitization mechanism, providing automated Prompt Defense, Toxicity Detection, and PII Masking to protect against malicious payloads at runtime.
Audit Metadata