experience-ui-bundle-mfa-configure
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the official Salesforce CLI (
sf) andjqto perform administrative tasks. These commands are scoped to querying organization data, deploying metadata, and managing user assignments, which is standard for Salesforce development workflows. - [DYNAMIC_EXECUTION]: The skill includes a reference for running anonymous Apex code via
sf apex runto grant guest users access to login classes. This code is static, serves a specific documented purpose for Experience Site login functionality, and does not incorporate untrusted external input. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files (e.g.,
sfdx-project.jsonand.network-meta.xml) and organization query results. While these are external inputs, they are standard components of a Salesforce DX project. The risk is minimized by the skill's instructions to use structured parsing (viajq) and declarative metadata updates. - [PRIVILEGE_MANAGEMENT]: The skill performs actions that modify security settings (creating
PermissionSetAssignmentandSetupEntityAccessrecords). These actions are the primary and intended purpose of the skill to enable MFA and ensure proper login access, rather than an attempt at unauthorized privilege escalation.
Audit Metadata