service-itsm-teams-coordinate
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to read sensitive authentication data, specifically a Microsoft Entra Client Secret, from the
TEAMS_ENTRA_CLIENT_SECRETenvironment variable or a user-provided secret file path. This data is subsequently used to configure Salesforce Named Credentials and Auth Providers via API. While this method is intended to prevent credential exposure in chat logs, it involves the programmatic access of sensitive local files. - [INDIRECT_PROMPT_INJECTION]: The orchestrator manages a complex state machine that ingests external data to drive system configuration, creating an attack surface for indirect prompt injection.
- Ingestion points: The skill ingests the Microsoft Entra Client ID, Tenant ID, and local secret file paths from the user through the conversation in
SKILL.md. - Boundary markers: The flow incorporates mandatory "HALT" points that require explicit human confirmation or the appearance of specific tokens (e.g., "installed") before proceeding to state-changing operations.
- Capability inventory: The skill uses the
Readtool to access the local environment and delegates write operations to child skills that perform API calls to modify Salesforce org settings, permission sets, and messaging channels. - Sanitization: The orchestrator does not explicitly define sanitization or validation logic for the identifiers provided by the user before they are passed to the delegated child skills for API execution.
Audit Metadata