service-omni-agent-users-create
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts to invoke the Salesforce CLI (
sf) for org discovery, metadata querying, and user provisioning tasks. The test suite also utilizes subprocess calls to verify security contracts. - [DYNAMIC_EXECUTION]: The skill generates Anonymous Apex code by interpolating validated parameters into a local template (
assets/create-users.apex.template) and executes it on the target Salesforce org using the CLI. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill generates temporary passwords for new users. To prevent exposure, it implements a fail-closed mechanism using the Salesforce Tooling API to verify that no active TraceFlags (debug logs) exist for the running user, ensuring passwords are not logged in plaintext on the Salesforce platform.
- [SAFE_PRACTICE]: Generated credentials are never printed to the standard output; instead, they are written to a local JSON file with restricted filesystem permissions (mode 0600) for secure retrieval.
- [SAFE_PRACTICE]: The skill includes a production guardrail that validates the Salesforce organization type before proceeding, preventing accidental execution against production customer environments.
Audit Metadata