service-omni-supervisor-config-deploy

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill performs strict validation on all user-supplied inputs, including queue names and profile identifiers, using regular expressions (e.g., ^[A-Za-z0-9_]{1,80}$) to prevent SOQL and XML injection attacks.\n- [SAFE]: A safety guard in scripts/deploy-and-report.sh queries the Salesforce Organization object to ensure the target environment is a Sandbox, Developer Edition, or Trial org, preventing unauthorized modifications to production data.\n- [DYNAMIC_EXECUTION]: The script materializes Metadata API artifacts in a temporary directory secured with umask 077 and chmod 700, ensuring that resolved configuration data is not accessible to other users on the system and is cleaned up after execution.\n- [COMMAND_EXECUTION]: The skill uses the official Salesforce CLI (sf) and jq for all environment interactions and data processing. These tools are used with pre-validated parameters and the script logic accounts for asynchronous operation and polling.\n- [SAFE]: The subprocess.run call identified in scripts/tests/_bootstrap.py is part of a testing framework used to verify the bash script's behavior using mocked CLI dependencies and does not pose a security risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 01:39 PM