dx-org-snapshot-manage
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes JSON output from Salesforce CLI commands, which can include untrusted data such as snapshot names or descriptions defined in a Salesforce Dev Hub.
- Ingestion points: The agent processes output from
sf org list snapshotandsf org get snapshotas described in SKILL.md and references/cli_flags.md. - Boundary markers: There are no explicit boundary markers or instructions to treat the command output as untrusted or to ignore embedded instructions.
- Capability inventory: The skill can execute shell commands via the Bash tool and write results to the local filesystem (e.g.,
force-app/main/adk-eval-output/). - Sanitization: The instructions specifically require the agent to use the "complete, unmodified JSON response," providing no opportunity for sanitization or filtering of the ingested metadata.
Audit Metadata