salesforce-performance-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates how to fetch and process data from external Salesforce API endpoints (e.g., using
conn.queryandconn.bulk2.queryinSKILL.md). This creates an ingestion surface where data from the Salesforce environment, if maliciously crafted, could potentially influence agent behavior. - Ingestion points:
SKILL.md(Step 1, Step 2, and Step 4 snippets retrieving account and contact records). - Boundary markers: None present in the provided code examples to separate external data from instructions.
- Capability inventory: The skill is configured with
Read,Write, andEdittool access and utilizes thejsforcelibrary for comprehensive CRM operations. - Sanitization: The performance-focused examples do not include explicit validation or sanitization of the retrieved record fields.
Audit Metadata