sf-industry-commoncore-flexcard
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user requirements and technical schema definitions from Integration Procedures to generate UI metadata (FlexCards). This creates an indirect prompt injection surface where malicious data in the source Integration Procedure could influence the generated UI configuration.\n
- Ingestion points: Phase 1 requirements gathering in
SKILL.mdand Integration Procedure field mapping inreferences/data-binding-guide.md.\n - Boundary markers: The skill defines explicit "Generation Guardrails" and a 130-point scoring rubric to validate generated output.\n
- Capability inventory: Generation of
OmniUiCardmetadata and documentation of CLI-based metadata deployment commands.\n - Sanitization: Implements a scoring rubric designed to block deployment if quality and safety thresholds are not met.\n- [COMMAND_EXECUTION]: The skill documentation includes examples of Salesforce CLI (
sf) commands for metadata querying and deployment. These are standard developer tools for the target Salesforce Industries environment and utilize established authentication workflows.
Audit Metadata