b2c-page-designer
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of components that ingest and render data configured in the Salesforce Page Designer editor.
- Ingestion points: Attributes are accessed via the
context.contentobject in component scripts such asexperience/components/banner.js. - Boundary markers: The provided ISML templates do not include specific delimiters or instructions to isolate potentially untrusted content.
- Capability inventory: The skill utilizes standard Salesforce Script APIs for storefront rendering logic.
- Sanitization: Code examples for rich text (markup) attributes recommend using
encoding="off". While this is a standard platform requirement for rendering formatted HTML from a CMS, it represents a potential XSS surface if the source data is not fully trusted.
Audit Metadata