field-service-mobile-branding-configure
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly forbids shell execution. The 'Runtime contract' section in SKILL.md states there is no dependency on the execution environment and no local scripts or temp files are used.
- [DATA_EXFILTRATION]: No sensitive data access or exfiltration patterns were detected. Network operations are limited to 'WebFetch' for ingesting public brand guidelines from URLs and standard Salesforce REST API calls (GET, PATCH) dispatched through the platform runtime.
- [PROMPT_INJECTION]: No malicious override or bypass instructions were found. The skill instructions focus on valid color derivation logic, WCAG contrast validation formulas, and standard Salesforce object updates.
- [REMOTE_CODE_EXECUTION]: There are no remote code execution patterns. All logic (contrast calculations, color mapping) is performed inline by the agent based on provided mathematical formulas.
- [PRIVILEGE_ESCALATION]: The skill performs an authorization probe and checks Field-Level Security (FLS) via a describe call before attempting updates, ensuring it operates within the user's existing permissions.
- [DYNAMIC_CONTEXT_INJECTION]: The skill does not use dynamic context injection (!
command) syntax.
Audit Metadata