service-itsm-teams-itdesk-configure
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
mcp__headless-360__dispatchtool to perform state-changing operations via Salesforce REST API endpoints, specifically modifying organization preferences and creating permission set assignment records. - [EXTERNAL_DOWNLOADS]: The skill includes links to the official Microsoft Teams marketplace and Salesforce help documentation, which are verified well-known and trusted sources.
- [DATA_EXFILTRATION]: The skill queries the
Userobject for information including Name, Username, and Email. This data is displayed to the administrator to facilitate the selection of specific users for feature access. - [PRIVILEGE_ESCALATION]: The skill automates the assignment of permission sets such as
TeamsForITSrvcsUser,MicrosoftGraphAccess, andTeams_Employee_ApiAccess. These actions are within the skill's primary scope and include instructions to wait for human confirmation and specific user selection. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from organization user records to generate management lists. It implements paged display (10 users at a time) and requires user confirmation, reducing the risk of accidental exploitation from embedded content in user fields.
Audit Metadata