authoring-serviceplanner-sra-topics
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes an agent that processes live conversation data from VoiceCalls, MessagingSessions, and Cases. This ingestion of untrusted external content represents a significant attack surface where participants could attempt to influence the agent's behavior.
- Ingestion points: Conversation data from live VoiceCall, MessagingSession, and Case records (SKILL.md).
- Boundary markers: The skill suggests using the
<scope>metadata field to define negative boundaries and providing explicit instructional steps to ground the agent (SKILL.md). - Capability inventory: The agent can trigger custom Actions (Prompt Templates or Flows) and perform Knowledge searches (SKILL.md).
- Sanitization: No explicit sanitization or filtering of the conversation content is described; the skill relies on the prompt scope to manage behavior.
- [PRIVILEGE_ESCALATION]: The documentation recommends a pattern of configuring backing Salesforce Flows with
SystemModeWithoutSharing. This setting allows the automation to bypass standard object-level security and sharing rules in the Salesforce organization, which may grant the agent access to data that the operating user should not normally see.
Audit Metadata