platform-apex-test-run
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is authored by a known vendor and adheres to industry-standard security practices for Salesforce development, including mandatory data isolation and the use of Test Data Factories to prevent side effects.\n- [COMMAND_EXECUTION]: The skill uses declared tools (sf, jq) for their intended purposes of interacting with Salesforce APIs and parsing JSON results. No unauthorized or suspicious command patterns were found.\n- [REMOTE_CODE_EXECUTION]: The Python script scripts/parse-test-results.py processes command output locally. It lacks network capabilities and does not utilize dynamic execution functions like eval() or exec().\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from test failure logs. 1. Ingestion points: TOOL_OUTPUT env var in scripts/parse-test-results.py. 2. Boundary markers: The Python script serves as a structured parser. 3. Capability inventory: sf CLI execution and delegation to sf-apex. 4. Sanitization: Uses regex and JSON deserialization to extract specific fields, effectively preventing data from being interpreted as instructions.
Audit Metadata