experience-search-coordinate
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content and metadata from external Salesforce CMS sources. While this data could contain instructions, the skill requires explicit user confirmation of search parameters (Step 3.2, Step 4.2) and user selection of results (Step 3.5, Step 4.5), which serves as a safeguard against automated payload execution.
- [COMMAND_EXECUTION]: The skill requires the 'sf' CLI tool. This is a standard, vendor-supported tool for Salesforce development, and its usage is appropriate for the skill's search and management functions.
- [DYNAMIC_EXECUTION]: The skill uses a 'load_skill' mechanism to hand off tasks to 'experience-cms-content-render'. This invocation uses a hardcoded skill name, which is a standard architectural pattern for modular agent skills.
- [EXTERNAL_DOWNLOADS]: Network operations are conducted via MCP tools (e.g., search_content_cms_channels) targeting Salesforce infrastructure. These operations are essential to the skill's purpose and use authenticated vendor endpoints.
Audit Metadata