b2c-job

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends using npx @salesforce/b2c-cli, which facilitates the download and execution of the official Salesforce CLI tool from the public NPM registry. This is standard practice for accessing well-known cloud management utilities.
  • [COMMAND_EXECUTION]: The skill provides documentation and examples for executing commands via the b2c CLI. These commands are restricted to administrative tasks within the Salesforce B2C Commerce ecosystem, such as running jobs, managing search indexes, and handling site archives.
  • [CREDENTIALS_UNSAFE]: The skill describes standard authentication practices for the CLI, including the use of environment variables and configuration files like dw.json. It also mentions the --unmask flag for debugging configuration, which is a legitimate diagnostic feature of the vendor's tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill involves processing external files such as jobs.xml and site archive contents. While this represents a data ingestion surface, the processing is performed by the external CLI tool rather than the agent's core prompt logic, and no patterns suggest bypassing safety guardrails.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 05:38 AM