service-omni-supervisor-permset-assign
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong input validation for all parameters. Specifically, permission set names are validated against a strict regular expression (
^[A-Za-z][A-Za-z0-9_]{0,79}$) inscripts/verify-and-assign.shbefore being used in shell commands or SOQL queries, mitigating injection risks. - [SAFE]: A production environment guard is enforced. The execution script queries the target organization metadata and blocks operations if the target is identified as a production org, restricting usage to sandboxes, trial environments, and developer editions.
- [SAFE]: The skill uses deterministic targets for user assignment by deriving usernames from a pattern combined with a unique organization suffix, ensuring the agent only interacts with specific supervisor users created for the tool's purpose.
- [SAFE]: Operations are idempotent and non-destructive. The script performs a read-before-write check to detect existing assignments and treats duplicate errors gracefully, preventing accidental or redundant state changes.
Audit Metadata