sf-flow
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes local metadata files to perform migrations, which creates a surface where malicious instructions embedded in the source files could influence the agent's behavior.
- Ingestion points: The skill reads existing Process Builder metadata from the local
force-app/main/default/flows/directory as part of its migration workflow (defined in SKILL.md). - Boundary markers: The instructions lack explicit boundary markers or delimiters to isolate the ingested metadata from the agent's internal reasoning or instructions.
- Capability inventory: The skill possesses significant capabilities, including file modification (
Write,Edit) and shell command execution via the Salesforce CLI (Bash(sf *)), which could be misused if an injection occurs (defined in SKILL.md). - Sanitization: There is no evidence of sanitization, filtering, or validation logic to ensure that instructions hidden within the XML metadata (such as in comments or label fields) are ignored during the migration process.
Audit Metadata