consumer-goods-tpe-datakit-deploy
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the
CGCloudAddonsstatic resource archive from the Salesforce instance URL using an authenticated REST API call. - [COMMAND_EXECUTION]: Utilizes the
sfCLI to perform organization status checks, query metadata, assign permission sets, and initiate project deployments. It also invokes platform-native utilities (tar,unzip) for archive extraction. - [REMOTE_CODE_EXECUTION]: Executes a deployment script (
deploy-tpm-tpe.js) that is downloaded and extracted as part of theCGCloudAddonspackage. The execution is part of the vendor-provided deployment workflow and originates from the user's own Salesforce environment. - [DYNAMIC_EXECUTION]: Dynamically runs a JavaScript file extracted from the downloaded static resource during the final deployment phase.
- [INDIRECT_PROMPT_INJECTION]: Analyzes XML metadata files (
.dataSourceObject-meta.xml) within the downloaded resource to automatically derive necessary field permissions. - Ingestion points: Reads package metadata from the local directory where
CGCloudAddonswas extracted inextract-crm-field-permissions.js. - Boundary markers: Not present; the skill relies on the structure of the vendor-provided metadata.
- Capability inventory: Metadata influences permission grants via REST API and determines the scope of deployment via
sfCLI. - Sanitization: Employs regex extraction and XML entity decoding to process metadata fields.
Audit Metadata