b2c-job
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends using
npx @salesforce/b2c-cli, which facilitates the download and execution of the official Salesforce CLI tool from the public NPM registry. This is standard practice for accessing well-known cloud management utilities. - [COMMAND_EXECUTION]: The skill provides documentation and examples for executing commands via the
b2cCLI. These commands are restricted to administrative tasks within the Salesforce B2C Commerce ecosystem, such as running jobs, managing search indexes, and handling site archives. - [CREDENTIALS_UNSAFE]: The skill describes standard authentication practices for the CLI, including the use of environment variables and configuration files like
dw.json. It also mentions the--unmaskflag for debugging configuration, which is a legitimate diagnostic feature of the vendor's tool. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing external files such as
jobs.xmland site archive contents. While this represents a data ingestion surface, the processing is performed by the external CLI tool rather than the agent's core prompt logic, and no patterns suggest bypassing safety guardrails.
Audit Metadata