sf-schema
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill functions by taking user requirements (such as names for custom objects, fields, and validation rules) and interpolating them into XML templates. This creates a vulnerability surface where a malicious user could provide input designed to produce malformed or unintended Salesforce metadata.
- Ingestion points: User instructions provided when requesting the creation of Salesforce schema elements (referenced in SKILL.md activation phrases).
- Boundary markers: The skill lacks explicit instructions for the agent to use delimiters or specific safety warnings when processing user-provided strings for insertion into metadata XML.
- Capability inventory: The skill environment allows file system write access and shell execution restricted to the Salesforce CLI (sf) via the Bash tool (SKILL.md allowed-tools).
- Sanitization: There is no evidence of input validation or escaping mechanisms to prevent users from attempting to inject malicious XML structures or unintended metadata properties through descriptive requirements.
Audit Metadata