consumer-goods-tpe-dashboard-configure
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
sfCLI to interact with Salesforce orgs. This is the standard and recommended tool for administrative tasks. The skill avoids sensitive data exposure by wrapping CLI calls in scripts that strip credentials likeaccessTokenfrom output. - [DYNAMIC_EXECUTION]: The skill generates anonymous Apex code at runtime using a templating system (
scripts/render-apex.js). This is handled securely by employing a dedicated escaping utility (scripts/soql-escape.js) to prevent SOQL/Apex injection when interpolating values into the templates. - [SAFE]: Authentication is handled via the user's existing Salesforce CLI session. The skill explicitly instructs the agent to never request passwords or authenticate on the user's behalf, relying instead on pre-authenticated sessions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from Salesforce APIs. It implements boundary checks and user confirmation steps before proceeding with critical phases, mitigating risks from potentially poisoned API responses.
Audit Metadata