life-sciences-territory-configure

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill uses the official Salesforce CLI (sf) to perform metadata deployments and data updates. The operations are consistent with the skill's stated purpose of territory management within a Salesforce environment.
  • [COMMAND_EXECUTION]: The skill executes shell commands using the sf CLI (sf project deploy start, sf data query, sf data update record). These commands are well-defined, and the skill includes a specific step to sanitize user-provided display names by removing special characters, spaces, and hyphens before generating API names used in commands and XML metadata. This prevents command and XML injection attacks.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles user-provided data for territory names. It mitigates potential injection risks by presenting a full XML preview to the user before deployment and performing strict alphanumeric sanitization on inputs. The workflow includes a 'stop-gate' verification to ensure the deployment resulted in the expected number of components before proceeding to activation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 07:34 AM
Security Audit — agent-trust-hub — life-sciences-territory-configure