experience-cms-content-generate
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a 'No-drift STOP rule' which prevents the agent from attempting to use non-specialized tools (like SOQL or CLI) if the primary CMS MCP tools are unavailable, reducing the risk of accidental misconfiguration or privilege bypass.
- [SAFE]: Content generation and editing are performed entirely on the server via the
promptparameter in thecreate_cms_contentandupdate_cms_content_varianttools. This ensures that the agent does not handle the underlying content schema or perform client-side assembly of content, relying instead on server-side validation. - [SAFE]: The skill uses strict identifier validation based on recognized Salesforce ID prefixes (
0Zu,9Pu,9Ps,MC,20Y) and requires server confirmation via read tools before any write operation is attempted on a record identified by the user. - [SAFE]: Delegation to the
experience-cms-content-type-generateskill is handled via a secure skill bridge and follows a well-defined protocol that pauses the parent skill and consumes only structured status responses, preventing state corruption. - [SAFE]: File operations are restricted to scanning local project directories for UIBundle metadata and persisting configuration to
content-metadata.jsonwithin the local project structure, which is consistent with standard local development workflows.
Audit Metadata