skills/forcedotcom/sf-skills/service-itsm-agentic-setup-agent-runtime-access-assign/Gen Agent Trust Hub
service-itsm-agentic-setup-agent-runtime-access-assign
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
sf(Salesforce CLI) andnodeto interact with Salesforce environments. All commands are structured to use existing CLI authentication contexts, specifically avoiding manual token extraction or management as a security best practice. The workflows involve querying metadata, assigning licenses (PSL), and managing permission sets (PermissionSetAssignment). - [SAFE]: The skill's architecture relies on several local helper scripts (e.g.,
classify-activated-agents.mjs,resolve-target-user.mjs) to process JSON output from the Salesforce CLI. These scripts are deterministic and do not perform network operations or access sensitive local files outside of the temporary JSON files generated during the skill's execution. All data exfiltration risks are mitigated by the 'never extract the access token' rule mandated in the instructions. - [SAFE]: The skill uses established Salesforce objects and APIs (
BotDefinition,PermissionSet,SetupEntityAccess) for its primary purpose of setting up Agentforce agents. No suspicious obfuscation, persistence mechanisms, or privilege escalation beyond the intended administrative task of granting user access were detected.
Audit Metadata