education-cloud-academic-calendar-generate
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by parsing user-provided documents (PDF, CSV, XLSX) and natural language descriptions to extract academic calendar dates.
- Ingestion points: Workflow Step 2 in
SKILL.mdspecifies parsing documents or natural language to extract year, term, and session dates. - Boundary markers: The instructions require the agent to convert parsed dates into absolute ISO 8601 format and explicitly use a local validation script before proceeding.
- Capability inventory: The skill possesses capabilities to create and update records in Salesforce via REST API and execute a local Python script (
scripts/validate_calendar_dates.py) via a subprocess. - Sanitization: Date extraction is restricted to specific fields (StartDate, EndDate, etc.), and all assembled data must pass the
scripts/validate_calendar_dates.pycheck for logical consistency and date range validity before any database writes occur.
Audit Metadata