field-service-objective-designer-configure
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the 'sf' CLI and Salesforce REST API via 'dispatch' to introspect environment metadata, including RecordTypes, sObject schemas for Service Goals, and SkillTypes. These operations are localized to the connected Salesforce environment and are necessary for the skill's primary function of objective design.
- [DATA_EXFILTRATION]: No exfiltration patterns were detected. The skill reads internal metadata to populate interview options but does not transmit data to non-vendor or unauthorized domains.
- [REMOTE_CODE_EXECUTION]: The skill does not perform arbitrary remote code execution. It references standard Salesforce tooling and follows a secure delegation pattern where write operations are performed by a dedicated downstream skill after user approval.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Salesforce org (metadata and picklist values). This represents a controlled surface for indirect injection; however, because the ingested data is typically administrator-controlled and the output is a structured JSON build specification, the risk is minimal.
Audit Metadata