service-itsm-teams-employee-agent-configure
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Salesforce CLI (
sf) to perform administrative tasks, includingproject deploy startfor metadata deployment anddata update recordfor activating messaging channels. These actions are performed using the agent's authorized session within the target Salesforce organization. - [PRIVILEGE_ESCALATION]: The skill automates the creation and assignment of 'Agent Access' permission sets. To mitigate risk, the skill includes a mandatory instruction for the agent to obtain explicit user approval before performing these Role-Based Access Control (RBAC) assignments.
- [DYNAMIC_EXECUTION]: The skill generates and modifies technical metadata XML files (e.g.,
MessagingChannel,PublicKeyCertificateSet, andEmbeddedServiceConfig) based on environment-specific variables like Site URLs and Org IDs before deploying them to the environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided inputs such as the 'Employee Site URL' and 'Org My Domain URL' to populate configuration endpoints. The skill manages this risk by using structured metadata templates and providing verification queries to ensure the configuration chain is correct before activation.
Audit Metadata