service-itsm-slack-itservice-configure
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Node.js script ('scripts/classify-user-access.mjs') for processing Salesforce API responses. This script uses deterministic logic to classify user accounts (distinguishing employees from system users) and to evaluate the success of permission set assignments. The script operates entirely on local file paths passed as arguments and does not perform network operations or access external resources.- [INDIRECT_PROMPT_INJECTION]: The skill processes Salesforce User record data (names, usernames, emails) which is treated as untrusted input.
- Ingestion points: Fetches active user records through the Salesforce Query API as described in SKILL.md and references/manage-user-access.md.
- Boundary markers: The agent is explicitly instructed to present a classified list of users to the operator and wait for manual confirmation/selection, preventing autonomous execution based on record data.
- Capability inventory: Includes capabilities to perform Salesforce writes (permission assignments, org preference updates) via MCP tools and to execute local scripts via Bash.
- Sanitization: Uses a local deterministic script to tag and classify users, which avoids the agent directly interpreting raw record fields as instructions and reduces the attack surface for prompt injection via record metadata.
Audit Metadata