service-itsm-teams-itdesk-configure

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the mcp__headless-360__dispatch tool to perform state-changing operations via Salesforce REST API endpoints, specifically modifying organization preferences and creating permission set assignment records.
  • [EXTERNAL_DOWNLOADS]: The skill includes links to the official Microsoft Teams marketplace and Salesforce help documentation, which are verified well-known and trusted sources.
  • [DATA_EXFILTRATION]: The skill queries the User object for information including Name, Username, and Email. This data is displayed to the administrator to facilitate the selection of specific users for feature access.
  • [PRIVILEGE_ESCALATION]: The skill automates the assignment of permission sets such as TeamsForITSrvcsUser, MicrosoftGraphAccess, and Teams_Employee_ApiAccess. These actions are within the skill's primary scope and include instructions to wait for human confirmation and specific user selection.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from organization user records to generate management lists. It implements paged display (10 users at a time) and requires user confirmation, reducing the risk of accidental exploitation from embedded content in user fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 04:35 PM
Security Audit — agent-trust-hub — service-itsm-teams-itdesk-configure