data360-code-extension-generate
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Salesforce CLI (
sf) to perform operations such as project initialization, code scanning, local testing, and deployment of extensions. These commands are standard for Salesforce development workflows. - [EXTERNAL_DOWNLOADS]: The skill relies on official Salesforce resources, requiring the installation of the
@salesforce/plugin-data-code-extensionCLI plugin and thesalesforce-data-customcodePython SDK from verified repositories. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading and writing data to Salesforce Data Lake Objects (DLO) and Data Model Objects (DMO). While this creates an ingestion point for external data, the risk is mitigated by the skill's specific purpose of data transformation within a controlled Python environment. Evidence chain:
- Ingestion points:
client.read_dlo,client.read_dmoinSKILL.mdandreferences/README.md. - Boundary markers: The skill instructs the agent to perform specific transformations (e.g., uppercasing fields) rather than open-ended analysis.
- Capability inventory: Shell command execution via
sfCLI, Docker for packaging, and Python execution. - Sanitization: Not explicitly implemented in the skill instructions; relies on the developer's implementation of the transformation logic.
Audit Metadata