Skills
skills/jeremylongshore/claude-code-plugins-plus-skills/salesforce-data-handling/Gen Agent Trust Hub

salesforce-data-handling

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill implements functions that interpolate user-provided identifiers into Salesforce Object Query Language (SOQL) strings, creating a surface for indirect injection if inputs are sourced from untrusted data.\n
  • Ingestion points: The contactId variable used in the exportContactData and deleteContactData functions within SKILL.md.\n
  • Boundary markers: Absent; the code snippets use standard JavaScript template literals to construct queries.\n
  • Capability inventory: The skill uses conn.query to read comprehensive record data and conn.sobject().destroy to delete records from the Salesforce environment.\n
  • Sanitization: No input validation or parameterization is applied to the identifiers before they are incorporated into the database commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 04:42 PM