field-service-mobile-branding-configure

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs and brand-guide pastes to derive branding configurations.\n
  • Ingestion points: External content fetched via WebFetch and user text parsing described in reference/derivation-methodology.md.\n
  • Boundary markers: A mandatory user confirmation step in the workflow (SKILL.md step 5) requires explicit approval of the derived scheme before any application to the organization.\n
  • Capability inventory: Updates FieldServiceMobileSettings records using sObject PATCH operations via the Salesforce REST API.\n
  • Sanitization: All derived hex values are validated against the regex ^#[0-9A-Fa-f]{6}$ to ensure only valid color codes are processed.\n- [SAFE]: The skill adheres to security best practices by performing an authentication probe before processing data and verifying Field-Level Security (FLS) for all 14 color fields before attempting updates.\n- [COMMAND_EXECUTION]: No shell commands, local scripts, or external executables are utilized. All operations are dispatched through a restricted API runtime for Salesforce org interactions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 02:32 PM
Security Audit — agent-trust-hub — field-service-mobile-branding-configure