service-omni-supervisor-users-create
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts (
scripts/detect-existing.shandscripts/run-create.sh) to execute Salesforce CLI (sf) commands. These tools are used for querying org metadata, checking user status, and executing administrative Apex code. - [DYNAMIC_EXECUTION]: In
scripts/run-create.sh, the skill dynamically populates an Apex template (assets/create-supervisors.apex.template) with values like user count and profile IDs. This code generation is protected by strict regex-based validation of all interpolated variables to ensure only expected alphanumeric patterns are processed. - [SAFE]: Several robust security controls are implemented to protect the target environment:
- Production Guardrail: The
detect-existing.shscript verifies the org type and blocks execution if the target is identified as a production customer org. - Log Safety (TraceFlag Gate): Before setting user passwords via Apex,
run-create.shperforms a Tooling API query to ensure no active debug TraceFlags exist for the current user. This prevents plaintext passwords from being captured in Salesforce system logs. - Secure Credential Handling: Generated passwords are never emitted to standard output (stdout) or stored in environment variables. Instead, they are written to a restricted local file (
CREDENTIALS.json) with filesystem permissions set to 0600 (read/write for the owner only).
Audit Metadata