sf-datacloud-prepare
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages workflows for unstructured document ingestion (e.g., SharePoint) and Document AI extraction, which are primary vectors for indirect prompt injection. \n
- Ingestion points: Processes external data via 'sf data360 data-stream run' and unstructured document connectors as described in SKILL.md and README.md. \n
- Boundary markers: The instructions lack explicit guidance for the agent to treat document content as untrusted or to use delimiters to prevent instruction leakage into the model context. \n
- Capability inventory: The skill possesses the capability to execute shell commands ('sf data360') and run local scripts ('send-data.py', 'diagnose-org.mjs') which could be influenced by injected instructions. \n
- Sanitization: No sanitization or filtering logic is specified for the ingested content before it is processed by the agent. \n
- [COMMAND_EXECUTION]: The skill provides extensive wrappers and examples for the 'sf data360' CLI plugin and instructs the agent to run local Python and Node.js scripts. \n
- Evidence: SKILL.md and README.md contain numerous CLI commands for data stream management and instructions for executing 'python3 send-data.py' for API testing purposes.
Audit Metadata