field-service-sobject-create-configure
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Salesforce API responses (
describeandqueryoperations) to determine how to construct and execute subsequent write operations (create,update). - Ingestion points: Data enters the agent context via
GET /services/data/v67.0/sobjects/{SObjectName}/describeandGET /services/data/v67.0/querycalls to the Salesforce API. - Boundary markers: The instructions do not define explicit boundary markers or provide warnings to ignore potential instructions embedded within the retrieved data.
- Capability inventory: The skill possesses significant capabilities, including record creation, modification, and deletion through
POST,PATCH, andDELETEoperations against the Salesforce API. - Sanitization: The workflow relies on filtering metadata (e.g., checking
createable:true) but lacks explicit validation or sanitization steps for the data values retrieved from the external source before they are used to drive decision-making logic.
Audit Metadata