field-service-mobile-branding-configure
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs and brand-guide pastes to derive branding configurations.\n
- Ingestion points: External content fetched via
WebFetchand user text parsing described inreference/derivation-methodology.md.\n - Boundary markers: A mandatory user confirmation step in the workflow (SKILL.md step 5) requires explicit approval of the derived scheme before any application to the organization.\n
- Capability inventory: Updates
FieldServiceMobileSettingsrecords using sObjectPATCHoperations via the Salesforce REST API.\n - Sanitization: All derived hex values are validated against the regex
^#[0-9A-Fa-f]{6}$to ensure only valid color codes are processed.\n- [SAFE]: The skill adheres to security best practices by performing an authentication probe before processing data and verifying Field-Level Security (FLS) for all 14 color fields before attempting updates.\n- [COMMAND_EXECUTION]: No shell commands, local scripts, or external executables are utilized. All operations are dispatched through a restricted API runtime for Salesforce org interactions.
Audit Metadata