consumer-goods-tpe-datakit-deploy

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the CGCloudAddons static resource archive from the Salesforce instance URL using an authenticated REST API call.
  • [COMMAND_EXECUTION]: Utilizes the sf CLI to perform organization status checks, query metadata, assign permission sets, and initiate project deployments. It also invokes platform-native utilities (tar, unzip) for archive extraction.
  • [REMOTE_CODE_EXECUTION]: Executes a deployment script (deploy-tpm-tpe.js) that is downloaded and extracted as part of the CGCloudAddons package. The execution is part of the vendor-provided deployment workflow and originates from the user's own Salesforce environment.
  • [DYNAMIC_EXECUTION]: Dynamically runs a JavaScript file extracted from the downloaded static resource during the final deployment phase.
  • [INDIRECT_PROMPT_INJECTION]: Analyzes XML metadata files (.dataSourceObject-meta.xml) within the downloaded resource to automatically derive necessary field permissions.
  • Ingestion points: Reads package metadata from the local directory where CGCloudAddons was extracted in extract-crm-field-permissions.js.
  • Boundary markers: Not present; the skill relies on the structure of the vendor-provided metadata.
  • Capability inventory: Metadata influences permission grants via REST API and determines the scope of deployment via sf CLI.
  • Sanitization: Employs regex extraction and XML entity decoding to process metadata fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 12:21 PM