agentforce-generate
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the AgentScript SDK from Salesforce's official GitHub repository and the public NPM registry. These sources are recognized as trusted and well-known services.
- [COMMAND_EXECUTION]: The skill includes Python and JavaScript scripts that automate interaction with the Salesforce CLI to validate agent bundles and query metadata. Command arguments are handled safely to prevent shell injection.
- [PROMPT_INJECTION]: Reference documentation includes security guardrail templates for agents, such as instructions to protect system prompts and ignore override attempts. These templates are intended to be used as safety best practices for the agents being developed.
- [REMOTE_CODE_EXECUTION]: The skill generates Salesforce metadata, including Apex classes and Flow XML files, based on configurations in .agent files. This automated code generation is an intended function for scaffolding agent actions, and the setup scripts for the local toolchain are sourced from the vendor's own repositories.
Audit Metadata