service-omni-agent-users-create
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill generates passwords programmatically and uses a sophisticated TraceFlag check to ensure no Salesforce debug logging is active before setting passwords. This prevents plaintext credentials from being recorded in the org's ApexLog. Passwords are saved to a local file with restricted permissions (0600) and are never emitted to stdout or tool transcripts.
- [COMMAND_EXECUTION]: Execution of shell commands via the Salesforce CLI (
sf) is used for legitimate administrative tasks. Input variables (Count, Profile ID, Suffix) are strictly validated against alphanumeric regex patterns in the shell scripts prior to being used in command arguments or Apex templates. - [DYNAMIC_EXECUTION]: The skill populates an Apex template at runtime. This process is protected against injection by the aforementioned strict input validation. The skill also performs an in-transaction idempotency check within the Apex code to prevent duplicate user creation.
- [SAFE_PRACTICES]: Includes a multi-factor production guardrail that queries the target organization's metadata (IsSandbox, TrialExpirationDate, OrganizationType) to ensure the skill only operates on development, sandbox, or trial environments, refusing execution on real customer production orgs.
Audit Metadata