education-cloud-multi-campus-configure
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (PDF, URL, CSV) which constitutes a potential attack surface for indirect prompt injection.
- Ingestion points: Step 1 uses the
Readtool for files and fetches content from user-provided URLs. - Boundary markers: Step 3 requires a mandatory visual confirmation of the parsed tree using a specific visualization template before any record processing occurs.
- Capability inventory: The skill has the capability to write, update, and delete Salesforce records (Account, BusinessProfile, RecordType) via the
headless-360MCP tool and execute shell commands via thesfCLI. - Sanitization: The workflow enforces human verification at multiple stages (Steps 3 and 6) and prohibits silent data source substitution to maintain data integrity.
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to invoke thesfCLI (Salesforce CLI). This is a standard administrative tool for the vendor's ecosystem and is used here for legitimate environment verification and record management. - [EXTERNAL_DOWNLOADS]: The skill fetches data from remote URLs to parse organizational structures. It includes a specific safety constraint that prevents the agent from using alternative third-party sources (like search results) if the primary URL fails, ensuring that only user-authorized sources are processed.
Audit Metadata