service-omni-supervisor-users-create
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Uses the
sfCLI (Salesforce CLI) to interact with orgs, perform queries, and execute anonymous Apex. All commands are targeted at the user-specified org alias and follow a deterministic pattern for user creation. - [CREDENTIALS_SAFE]: Implements a high-security pattern for password management.
System.setPasswordis used via Anonymous Apex only after verifying that noTraceFlagis active for the current user (which would otherwise log the plaintext password). Generated passwords are saved to a file with0600permissions (CREDENTIALS.json) and are explicitly excluded from the JSON output returned to the agent. - [REMOTE_CODE_EXECUTION]: Executes dynamic Apex code on the Salesforce platform using
sf apex run. The code is generated from a local template (assets/create-supervisors.apex.template) with strict input validation for tokens likeCOUNT,PROFILE_ID, andSUFFIXto prevent injection. - [PRIVILEGE_ESCALATION]: Checks for
PermissionsModifyAllDataandPermissionsManagePasswordPoliciesbefore proceeding. The skill does not attempt to elevate its own local shell privileges and operates within the context of the authenticated Salesforce user. - [SAFE_TO_WRITE_GUARD]: Includes a production guardrail that restricts execution to Sandboxes, Trial orgs, and Developer/Base editions, preventing accidental modification of production customer environments.
Audit Metadata