b2c-config
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- Data Exposure (HIGH): The skill documents the use of the
b2c setup inspect --unmaskcommand, which explicitly displays passwords, secrets, and API keys that are otherwise redacted. This facilitates the exposure of sensitive authentication data to the agent's output. \n - Evidence: Instructions for using
--unmaskto "Show actual passwords, secrets, and API keys".\n- Sensitive File Access (HIGH): The skill instructs the agent to read and verify configuration from sensitive local paths includingdw.jsonand~/.mobify. \n - Evidence: References to
dw.jsonand~/.mobify(containing MRT API keys) throughout the documentation.\n- External Downloads (MEDIUM): The skill suggests running the CLI tool vianpx @salesforce/b2c-cli. This involves a remote package download and execution. Since the@salesforceorganization is not on the predefined list of trusted sources, this is classified as an unverifiable dependency. \n - Evidence: Reference to
npx @salesforce/b2c-clias a way to use the tool without global installation.
Audit Metadata