sra-agent-debugger
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is centered around Python scripts that interact with the Salesforce environment by executing shell commands.
- Evidence: The scripts trace_session.py and trace_case.py use the subprocess module to invoke sf CLI commands such as 'sf data query' and 'sf api request' to retrieve telemetry.
- Evidence: These commands are used to pull sensitive data including GenOpPlan and RecActorActionFeed records.
- [DYNAMIC_EXECUTION]: The skill includes a local web viewer that introduces dynamic execution surfaces.
- Evidence: viewer.py starts a local HTTP server on 127.0.0.1 (default port 8787 or 8080) to render trace data.
- Evidence: The web server includes a /trace endpoint that accepts record IDs via POST requests and executes them through shell commands.
- Evidence: The viewer script uses sys.path.insert to dynamically load modules from the skill's local directory.
- [INDIRECT_PROMPT_INJECTION]: The skill processes natural language data from external Salesforce records, creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context from Salesforce GenOpPlan (plans), Knowledge Articles (content), and interaction messages (transcripts) via SOQL and SQL queries.
- Boundary markers: The output text file uses section headers (e.g., '## Summary Plan'), but lacks explicit instructions for the analyzing agent to ignore malicious commands embedded within the retrieved data.
- Capability inventory: The analyzing agent has access to powerful tools including shell command execution (via sf CLI) and local file system access.
- Sanitization: While the HTML viewer uses html.escape, the primary diagnostic text files do not appear to sanitize or filter natural language content pulled from the external environment.
Audit Metadata