skills/forcedotcom/sf-skills/service-itsm-agentic-setup-itsm-agentforce-permset-assign/Gen Agent Trust Hub
service-itsm-agentic-setup-itsm-agentforce-permset-assign
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Salesforce CLI (
sf) to query and manage org configuration. It operates using the existing authenticated CLI session and explicitly prohibits raw access token extraction, adhering to security best practices. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Salesforce API responses (Ingestion points:
sfCLI output captures in/tmp/). It employs local Node.js scripts as a validation layer to classify results deterministically (Boundary markers: script-based classification logic replaces prose interpretation). While the skill can modify org permissions (Capability inventory:sf org assign permset), all inputs are strictly validated (Sanitization: Regex validation for Salesforce IDs inresolve-target-user.mjsand hardcoded allow-lists for persona names). - [SAFE]: Administrative actions, including permission set and license assignments, are gated by a mandatory confirmation prompt (
AskUserQuestion), ensuring no modifications occur without explicit user consent. - [SAFE]: All logic is contained within local scripts using standard libraries, with no remote code execution, external package downloads, or obfuscated code detected.
Audit Metadata