calling-prompt-templates-in-flows
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a pattern that ingests untrusted data (case descriptions and conversation transcripts) to ground generative AI prompt templates, creating a potential surface for indirect prompt injection.
- Ingestion points: Salesforce record data (Case Number, Subject, Description) and conversation transcripts (via
getConvTscpForRecord) are fetched inassets/inh-promptflow-get-case-and-transcript.flow-meta.xml. - Boundary markers: The prompt template in
assets/inh-case-draft-template.genAiPromptTemplate-meta.xmluses explicit delimiters (CONTEXT:) and instructions to the model to respond in a fixed format, which helps isolate the grounded context. - Capability inventory: The skill is capable of creating new records (
Create_Child_INH_Case) and updating records within the Salesforce environment, as seen inassets/inh-screenflow-draft-review-create.flow-meta.xml. - Sanitization: The
assets/PromptResponseToSkillIds.clsclass provides defensive parsing by validating that extracted tokens match the 15- or 18-character alphanumeric format of Salesforce IDs. Additionally, the screen flow includes a manual review step (Go_Over_AI_Generated) allowing a human user to verify and edit the AI-generated subject and description before any record is created.
Audit Metadata