b2c-custom-objects
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a technical reference for Salesforce B2C Commerce developers. It documents standard usage of the
dw/object/CustomObjectMgranddw/system/Transactionmodules for CRUD operations on custom data.\n- [SAFE]: Network interactions described in the skill target legitimate Salesforce Commerce Cloud domains (e.g.,api.commercecloud.salesforce.com) and standard OCAPI endpoints. Placeholders for authorization tokens are used appropriately in examples.\n- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for retrieving and processing data from Custom Object storage, which constitutes an attack surface for indirect prompt injection if the data source is attacker-controlled.\n - Ingestion points: Data is ingested via the
dw/object/CustomObjectMgrmodule and OCAPI search endpoints as shown inSKILL.md.\n - Boundary markers: The code examples do not demonstrate the use of boundary markers or instructions to ignore embedded commands in the processed data.\n
- Capability inventory: The skill provides instructions for full CRUD operations, including network-based writes and script-based deletions.\n
- Sanitization: The provided code uses
JSON.parseto handle retrieved data, relying on implicit data structure rather than explicit content sanitization.
Audit Metadata