skills/sshvarzman-salesforce/claude-skills/investigating-agentforce-architecture/Gen Agent Trust Hub
investigating-agentforce-architecture
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the Salesforce (sf) CLI to perform authentication and metadata listing. All commands are executed using list-based argument passing via subprocess.run to prevent shell injection. Inputs are pre-validated in scripts/_shared/fs_guard.py using strict regex filters for identifiers and API names.
- [EXTERNAL_DOWNLOADS]: Metadata is fetched from Salesforce REST and Tooling API instances. The skill implements a secure HTTP client in scripts/rest_client.py that proactively strips authorization headers during cross-host redirects and redacts sensitive tokens from error messages and logs.
- [PROMPT_INJECTION]: The skill processes natural language descriptions stored in Salesforce metadata, representing a surface for indirect prompt injection. Mitigation is achieved through rigorous identifier validation and the scrubbing of control characters in tools/sanitize.py and tools/write_emit_ctx.py before output generation.
- Ingestion points: Natural language metadata fields (e.g., Description) read via REST API in scripts/fetch_soql.py.
- Boundary markers: The skill renders a structured Markdown architecture document with explicit sections defined in scripts/render_architecture.py.
- Capability inventory: Subprocess execution of the sf CLI, network requests to Salesforce API domains, and file writing to localized data directories.
- Sanitization: Use of fs_guard.py for input validation and sanitize.py for output cleaning.
Audit Metadata