platform-deploy-validate
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes official Salesforce CLI tools (
sf) to validate deployments and classify orgs. It specifically usessf org display,sf project deploy start, andsf project deploy validatecommands via the Bash tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes validation failures and test results from external Salesforce environments to provide repair suggestions. This represents an attack surface for instructions embedded in org metadata or test logs.
- Ingestion points: JSON results returned by
sf project deploy validateandsf project deploy start(SKILL.md). - Boundary markers: The skill mandates the use of the
--jsonflag for all CLI calls, ensuring structured data parsing. - Capability inventory: Shell command execution (Bash) and local file writing (Write) to
.sfdx/last-validation.json. - Sanitization: Focuses on extracting specific fields (
componentFailures,runTestResult.failures) from the structured JSON response.
Audit Metadata