consumer-goods-promotion-bo-api-deploy
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Salesforce CLI (
sf) to perform org discovery, query data, and deploy metadata. All operations are targeted at the user's authenticated environment using standard developer tooling. - [DYNAMIC_EXECUTION]: The skill generates custom Apex code at runtime based on user-supplied parameters during an interview phase. To mitigate risks associated with code generation, the skill implements a human-in-the-loop checkpoint where the generated source code is displayed for user review and requires explicit confirmation before deployment.
- [INDIRECT_PROMPT_INJECTION]: External data from intent files or mass-upload templates is ingested to influence REST payloads and code generation. This attack surface is mitigated by deriving a validation contract directly from the target organization's schema and providing manual verification of generated artifacts.
- [SAFE]: The skill demonstrates defensive security practices by explicitly instructing against the extraction of sensitive access tokens and relying on CLI-managed session handling to interact with APIs.
Audit Metadata