configuring-test-provider
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
sf api requestcommand to perform REST API calls to Salesforce. This is standard functionality for DevOps Center configuration and depends on a previously authenticated org alias. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external data from API responses to drive subsequent actions.
- Ingestion points: JSON output from the
testProvidersAPI call inSKILL.md. - Boundary markers: Not explicitly used for the tool output.
- Capability inventory: Subsequent
POSTrequest used to configure providers inSKILL.md. - Sanitization: The skill relies on agent logic to extract specific fields and includes a mandatory human-in-the-loop confirmation gate in Step 2 to mitigate potential risks from malicious data.
Audit Metadata