service-itsm-teams-itdesk-configure
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
headless-360tool to execute state-changing operations on the Salesforce platform, including updating organizational preferences (OrgHasITSMFulfillerTeams) and creating or assigning permission sets. - [EXTERNAL_DOWNLOADS]: The skill provides the user with verified links to the Microsoft Marketplace and official Salesforce Help documentation for manual steps that cannot be automated.
- [INDIRECT_PROMPT_INJECTION]: The skill queries user data from the Salesforce organization to display to the agent; however, it implements safety measures including paging (10 users per page) and explicitly requiring the user to confirm specific individuals before granting access or assigning permissions.
- [PRIVILEGE_ESCALATION]: While the skill manages permissions (assigning
TeamsForITSrvcsUser,MicrosoftGraphAccess, and creating anAPI Enabledpermission set), these actions are the primary, documented purpose of the skill and require the user's underlying credentials to have sufficient administrative authority to perform these API calls via theheadless-360tool.
Audit Metadata