service-de-channel-consent-configure
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input for messaging prompts and keywords which are then interpolated into shell command templates.\n
- Ingestion points: Stage 3 and 4 in SKILL.md collect user-supplied values for OptInPrompt, DoubleOptInPrompt, and various keyword fields like OptOutKeywords.\n
- Boundary markers: The skill instructs the agent to wrap inputs in single quotes within double-quoted CLI arguments. While this prevents CLI parsing errors for spaces, it does not prevent the underlying shell from expanding command sequences like backticks or $() if they are present in the user input.\n
- Capability inventory: The skill uses the sf CLI to query, create, and update records in the Salesforce org and writes results to temporary files in /tmp.\n
- Sanitization: No explicit guidance is provided to the agent for sanitizing or escaping shell-sensitive characters from the user-provided prompt strings before command execution.\n- [COMMAND_EXECUTION]: The skill utilizes the sf CLI tool to perform its primary functions, which is the standard, expected method for managing Salesforce resources by the vendor.
Audit Metadata