experience-content-media-stock-image-search
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The script
scripts/download-stock-image.pyprogrammatically retrieves a Salesforce access token using the commandsf org auth show-access-token. While this is used to authenticate image downloads from the platform, handling high-privilege session tokens within a skill script increases the impact of any potential compromise. - [DATA_EXFILTRATION]: The skill implements a pattern that retrieves a sensitive credential and immediately sends it as a Bearer token to a URL provided via the
--urlargument. The script only validates that the URL useshttps://but does not restrict it to trusted Salesforce or vendor domains, creating a risk of token exfiltration if the agent is directed to a malicious endpoint. - [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute CLI tools includingsfandcode. Although it implements basic path traversal checks (blocking..and/in the asset ID), it remains dependent on the integrity of the data returned by the MCP tools and processed by the agent. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests metadata (titles, captions) and technical parameters (URLs, IDs) from an external MCP server and passes them directly to a script with network and credential access. Maliciously crafted metadata in the search results could potentially influence the agent to execute the download script with an attacker-controlled URL.
Audit Metadata