sf-data

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data files that could serve as a vector for indirect prompt injection.\n
  • Ingestion points: The skill reads data from several sources including data/accounts.json, accounts.csv, data/plan.json, and data/seed/*.json using commands like sf data import tree and sf data upsert bulk (SKILL.md, data-patterns.md).\n
  • Boundary markers: No specific boundary markers or instructions are provided to the agent to disregard natural language instructions that might be contained within the records of the imported files.\n
  • Capability inventory: The skill possesses significant capabilities, including file system access (Read, Write, Edit), shell command execution (Bash(sf *)), and the ability to execute code on the Salesforce server (sf apex run).\n
  • Sanitization: The instructions do not define any validation or sanitization steps for the data contained within the CSV or JSON files before they are processed by the agent or sent to Salesforce APIs.\n- [COMMAND_EXECUTION]: The skill relies on executing shell commands and scripts to manage Salesforce data.\n
  • Evidence: Uses the Bash tool to execute sf CLI commands for data querying, bulk loading, and record deletion.\n
  • Evidence: Includes a bash script seed-sandbox.sh for automating data ingestion in sandbox environments (SKILL.md).\n
  • Evidence: Provides curl command patterns for interacting with the Salesforce REST API (data-patterns.md).\n- [DYNAMIC_EXECUTION]: The skill uses anonymous Apex to perform complex data setup tasks on the Salesforce platform.\n
  • Evidence: Uses the sf apex run -f command to execute local .apex files containing arbitrary server-side logic (SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 10:04 PM