service-omni-sidebar-configure
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/enable-and-report.shexecutes Salesforce CLI (sf) commands to query, retrieve, and deploy metadata. These operations are standard for Salesforce administrative tasks and are performed using the agent's authorized tools. - [PRIVILEGE_ESCALATION]: The skill implements a
safe_to_writeguard that explicitly blocks execution if the target organization is identified as a production environment. It only allows modifications on sandboxes, developer editions, or trial organizations, which is a significant safety feature preventing unauthorized or accidental production changes. - [PROMPT_INJECTION]: The skill includes rigorous input validation for the
app_developer_nameargument, using a restrictive regular expression (^([A-Za-z][A-Za-z0-9]{0,14}__)?[A-Za-z][A-Za-z0-9_]{0,79}$) to ensure the input conforms to Salesforce metadata naming conventions and prevents shell injection or unexpected behavior. - [DYNAMIC_EXECUTION]: The testing utility
scripts/tests/_bootstrap.pyusessubprocess.runto execute the skill's main bash script. It also dynamically creates a mocksfexecutable in a temporary directory to simulate Salesforce API responses during testing. These patterns are localized to the test harness and represent standard, safe software testing practices.
Audit Metadata