salesforce-automation
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from a Salesforce environment (leads, contacts, opportunities, and SOQL query results), creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent context through tools such as
SALESFORCE_SEARCH_LEADS,SALESFORCE_GET_OPPORTUNITY, andSALESFORCE_RUN_SOQL_QUERY(defined in SKILL.md). - Boundary markers: The skill defines a 'Record mutation boundary' in SKILL.md to verify IDs and preview changes, though it lacks explicit technical delimiters (like XML tags or markdown blocks) to isolate untrusted field content from instructions.
- Capability inventory: The skill possesses the capability to write back to the external environment via tools like
SALESFORCE_CREATE_LEAD,SALESFORCE_UPDATE_TASK, andSALESFORCE_MASS_TRANSFER_OWNERSHIP. - Sanitization: The instructions emphasize manual reconciliation of uncertain records and user authorization for field updates, but do not specify programmatic sanitization of text fields retrieved from Salesforce.
Audit Metadata