b2c-import-set-migrations
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists entirely of instructional documentation and evaluation data. No executable scripts, binaries, or automated network operations are included within the skill package. It documents the use of official vendor tools and follows secure practices such as advising the removal of secrets from exported archives.- [INDIRECT_PROMPT_INJECTION]: The skill describes a feature where the CLI tool reads
README.mdfiles from within migration archives and displays them to the user as post-import notes. This represents a potential surface where external instructions could be presented to the agent, though the context is clearly defined for manual developer follow-up. - Ingestion points:
README.mdfiles located within cartridgemetadata/or projectmigrations/directories. - Boundary markers: The skill explains that this content is consolidated into a "Post-import notes" summary intended for user review.
- Capability inventory: The skill facilitates management of Salesforce Commerce Cloud instances via CLI commands (
b2c job import-set). - Sanitization: The documentation explicitly instructs users to inspect all files and remove secrets, passwords, and environment-specific values before including them in the migration set.
Audit Metadata