service-itsm-agentic-setup-incident-sla-configure
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
mcp__headless-360__dispatchandmcp__headless-360__dispatch_readonlyto execute REST API calls against a Salesforce org. This is the primary intended function of the skill to configure SLA settings. The risk of command injection is mitigated by strict adherence to predefined HTTP routes and templates provided in the reference files, and by the fact that the MCP server signs requests using a JWT bound to the session. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Salesforce org (e.g., Incident field descriptions, Account names, and BusinessHours) to inform its configuration logic.
- Ingestion points:
SKILL.md(Phase 1, steps 3-6) andreferences/mcp-invocation.mddescribe fetching metadata and records viadispatch_readonly. - Boundary markers: The skill uses explicit confirmation gates (
AskUserQuestion) before any mutation, requiring the user to validate the plan derived from the ingested data. - Capability inventory: The skill can create and modify Salesforce records (MilestoneTypes, SlaProcesses, Entitlements, Incidents) but cannot execute arbitrary shell commands or access the local file system.
- Sanitization: The skill instructions require explicit confirmation of values (like Priority picklists) against the live org metadata before using them in API payloads.
Audit Metadata