integration-connectivity-connected-app-configure
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted data from local metadata files (.connectedApp-meta.xml, .eca-meta.xml) and has the capability to execute shell commands and modify files.
- Ingestion points: The workflow involves using 'Glob' and 'Read' tools to scan and ingest existing metadata files for security scoring (Workflow Step 4) and migration reviews (references/migration-guide.md).
- Boundary markers: The instructions do not specify the use of data delimiters or protective 'ignore' instructions when interpolating the content of these external files into the agent's context.
- Capability inventory: The skill possesses significant capabilities, including executing Salesforce CLI commands via 'Bash', as well as 'Write' and 'Edit' access to the project filesystem, which could be abused if an attacker places malicious instructions inside the metadata files being reviewed.
- Sanitization: No explicit sanitization or validation of the metadata content is performed before the agent processes it.
- [SAFE]: The skill is authored by 'forcedotcom', which corresponds to the official Salesforce organization. All external resources, including XML schemas (soap.sforce.com) and CLI tools (sf), are legitimate and established for Salesforce development.
- [SAFE]: The skill explicitly enforces security best practices, such as preventing the inclusion of consumer secrets in source control, requiring PKCE for public clients, and recommending the use of minimal OAuth scopes.
Audit Metadata