platform-mcp-tool-widget-coordinate
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the official Salesforce CLI (
sf) and thejqutility to interact with Salesforce APIs and process metadata. These operations are essential for its primary function of discovering tool schemas. - [EXTERNAL_DOWNLOADS]: It retrieves metadata descriptions from the Salesforce Actions REST API using authenticated sessions via the
sfCLI. This is a standard and expected behavior for a Salesforce development tool. - [DATA_EXPOSURE]: The skill reads local project files, specifically Apex classes and JSON samples, to determine data structures. It includes explicit rules against extracting sensitive credentials or tokens, focusing only on structural metadata.
- [PROMPT_INJECTION]: Instructions include strict boundaries and instructional delimiters to maintain agent focus and prevent role confusion. No patterns were found that attempt to bypass AI safety filters.
- [REMOTE_CODE_EXECUTION]: While the skill orchestrates other specialized generation skills, it does not download or execute arbitrary code from untrusted remote sources. It implements a 'Hard Rule' (Rule 11) to avoid shell metacharacters that could lead to command injection.
Audit Metadata