service-omni-supervisor-users-create

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Uses the sf CLI (Salesforce CLI) to interact with orgs, perform queries, and execute anonymous Apex. All commands are targeted at the user-specified org alias and follow a deterministic pattern for user creation.
  • [CREDENTIALS_SAFE]: Implements a high-security pattern for password management. System.setPassword is used via Anonymous Apex only after verifying that no TraceFlag is active for the current user (which would otherwise log the plaintext password). Generated passwords are saved to a file with 0600 permissions (CREDENTIALS.json) and are explicitly excluded from the JSON output returned to the agent.
  • [REMOTE_CODE_EXECUTION]: Executes dynamic Apex code on the Salesforce platform using sf apex run. The code is generated from a local template (assets/create-supervisors.apex.template) with strict input validation for tokens like COUNT, PROFILE_ID, and SUFFIX to prevent injection.
  • [PRIVILEGE_ESCALATION]: Checks for PermissionsModifyAllData and PermissionsManagePasswordPolicies before proceeding. The skill does not attempt to elevate its own local shell privileges and operates within the context of the authenticated Salesforce user.
  • [SAFE_TO_WRITE_GUARD]: Includes a production guardrail that restricts execution to Sandboxes, Trial orgs, and Developer/Base editions, preventing accidental modification of production customer environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 01:12 PM
Security Audit — agent-trust-hub — service-omni-supervisor-users-create