SquireX Security Rule Catalog

112 rules across 72 categories.

Action Configuration

Rule ID	Severity	Name
AGENTFORCE-1.2	🔴 High	Schema Synchronization Verification

Agent Flow Integrity

Rule ID	Severity	Name
AGENTFORCE-2.2	🟡 Medium	Transition Integrity

Agent Script Safety

Rule ID	Severity	Name
AGENTFORCE-2.3	🔴 High	Prompt Injection Defense Heuristics
AGENTFORCE-2.1	🟡 Medium	Validation Guard Clause Enforcement

AgentExchange Supply-Chain

Rule ID	Severity	Name
AGENTFORCE-SC-10	🚨 Critical	Tool Namespace Shadowing (Confused Deputy)
AGENTFORCE-SC-12	🔴 High	Transitive Prompt Poisoning
AGENTFORCE-SC-11	🔴 High	Unbound Gateway Activation

Agentforce for Commerce

Rule ID	Severity	Name
AGENTFORCE-17.1	🚨 Critical	Commerce Agent Without Idempotency Key
AGENTFORCE-17.2	🚨 Critical	Commerce Agent Amount Without Bounds Check

Agentic Architecture

Rule ID	Severity	Name
AGENTFORCE-7.1	🔴 High	Topic Action Bloat (God-Topic Prevention)
AGENTFORCE-7.2	🔴 High	Inadequate Skill Semantics
AGENTFORCE-8.1	🔴 High	Context Traversal Exfiltration (ForcedLeak Mitigation)
AGENTFORCE-7.3	🔴 High	Orphaned Bot Without AiEvaluationDefinition

Autonomous Scheduling

Rule ID	Severity	Name
AGENTFORCE-11.1	🚨 Critical	Unguarded Autonomous Scheduled Action
AGENTFORCE-11.2	🔴 High	Time-Window Privilege Drift

Custom Permission Enforcement

Rule ID	Severity	Name
AGENTFORCE-16.1	🔴 High	Agent Action Without Custom Permission Gate

Data Cloud Grounding

Rule ID	Severity	Name
AGENTFORCE-13.1	🚨 Critical	RAG Knowledge Source Without Schema Classification

Data Exfiltration

Rule ID	Severity	Name
AGENTFORCE-21.1	🚨 Critical	PII/PHI Payload Leakage in Tool Output

Data Exfiltration / Injection

Rule ID	Severity	Name
AGENTFORCE-21.2	🔴 High	Insecure Output Handling (Agent-to-XSS)

Einstein Copilot Studio Configuration

Rule ID	Severity	Name
AGENTFORCE-12.2	🚨 Critical	GenAiPlannerBundle API Version Drift
AGENTFORCE-12.1	🚨 Critical	Latent Memory Poisoning in Prompt Template

Excessive Agency

Rule ID	Severity	Name
AGENTFORCE-1.1	🚨 Critical	Mandatory User Confirmation
AGENTFORCE-20.1	🚨 Critical	DML Bypassing FLS in Invocable Actions
AGENTFORCE-20.2	🚨 Critical	Unconstrained ModifyAllData in Agent Context
SNOW-20.2	🚨 Critical	Role Masking Not Configured for Dynamic User Agent

External Service Security

Rule ID	Severity	Name
AGENTFORCE-15.2	🔴 High	Dynamic Cloaking via External RAG Source
AGENTFORCE-15.1	🔴 High	External Service Without Certificate Pinning

Governance

Rule ID	Severity	Name
AGENTFORCE-4.3	🔴 High	Synthetic Evaluation Completeness

Graph: Cascading Automation

Rule ID	Severity	Name
AGENTFORCE-32.1	🔴 High	Unintended Autonomous Blast Radius

Graph: Component Injection

Rule ID	Severity	Name
AGENTFORCE-34.1	🚨 Critical	Agent-to-UI XSS (Component Injection Graph)

Graph: MCP Identity Mismatch

Rule ID	Severity	Name
AGENTFORCE-33.1	🔴 High	MCP Over-Provisioning

Graph: PII Exfiltration Path

Rule ID	Severity	Name
AGENTFORCE-30.1	🚨 Critical	Context Window PII Poisoning (Graph)

Graph: Privilege Escalation Path

Rule ID	Severity	Name
AGENTFORCE-31.1	🚨 Critical	Autonomous Without-Sharing Escalation (Deep)

Grounding Security

Rule ID	Severity	Name
AGENTFORCE-3.1	🚨 Critical	Hardcoded Sensitive Indicators
AGENTFORCE-3.2	🚨 Critical	Field-Level Security Masking Alignment

Headless MCP Access

Rule ID	Severity	Name
AGENTFORCE-MCP-02	🚨 Critical	Broad Scope DevOps Pipeline Inheritance
AGENTFORCE-MCP-04	🚨 Critical	MCP Tool Definition Drift (Rug Pull Detection)
AGENTFORCE-MCP-01	🚨 Critical	Token Passthrough Exposure Configuration
AGENTFORCE-MCP-06	🔴 High	MCP Schema Parameter Injection
AGENTFORCE-MCP-03	🔴 High	Missing Protocol Scope Constraints
AGENTFORCE-MCP-05	🔴 High	Shadow MCP Server Detection
AGENTFORCE-MCP-07	🔴 High	MCP Server Network Exposure

Injection

Rule ID	Severity	Name
AGENTFORCE-FLOW-03	🔴 High	Variable Injection in DML

Instruction Integrity

Rule ID	Severity	Name
AGENTFORCE-9.1	🚨 Critical	Metadata Instruction Poisoning
AGENTFORCE-9.2	🔴 High	Cross-Topic Instruction Boundary

MCP Authentication

Rule ID	Severity	Name
AGENTFORCE-24.2	🔴 High	Missing Signature Validation on Agent Webhook

MuleSoft Agent Fabric

Rule ID	Severity	Name
AGENTFORCE-AF-01	🚨 Critical	Broker PII Routing Without Guard
AGENTFORCE-AF-02	🔴 High	LLM Provider Without Rate Limit
AGENTFORCE-AF-03	🔴 High	A2A Card Overpermissioned Scope
AGENTFORCE-AF-04	🔴 High	Broker Privilege Escalation via Routing
AGENTFORCE-AF-05	🟡 Medium	Bidirectional Agent Communication Without Broker

Multi-Agent Orchestration

Rule ID	Severity	Name
AGENTFORCE-18.1	🚨 Critical	Compositional Fragment Trap Risk
AGENTFORCE-18.2	🔴 High	Sybil Identity in Multi-Agent Orchestration
SNOW-18.2	🔴 High	Yokohama Agent Duplication Sybil

Network Security

Rule ID	Severity	Name
AGENTFORCE-API-01	🔴 High	External Callout Injection

OpenGraph Security

Rule ID	Severity	Name
AGENTFORCE-OG-01	🔴 High	OGP Metadata Prompt Injection
AGENTFORCE-OG-03	🔴 High	Attractive Metadata Attack via OGP
AGENTFORCE-OG-02	🟡 Medium	A2A Agent Card / OGP Trust Mismatch

Operational Reliability

Rule ID	Severity	Name
AGENTFORCE-10.1	🟡 Medium	Validation Rule Conflict

Orchestration Integrity

Rule ID	Severity	Name
AGENTFORCE-4.1	🔴 High	Planner Orchestration Completeness

Platform Event Security

Rule ID	Severity	Name
AGENTFORCE-19.1	🚨 Critical	Sub-agent Spawning via Platform Event
AGENTFORCE-19.2	🔴 High	CDC Without Field Filter in Agent Context

Privilege Escalation

Rule ID	Severity	Name
AGENTFORCE-FLOW-01	🚨 Critical	System Context Enforcement
AGENTFORCE-1.3	🔴 High	Target Context Privilege Analysis

Prompt Injection

Rule ID	Severity	Name
AGENTFORCE-PT-01	🚨 Critical	Template Context Poisoning

Resource Exhaustion

Rule ID	Severity	Name
AGENTFORCE-23.1	🔴 High	Non-Selective SOQL in Agent Tools (Agent DoS)

Runtime Capability Drift

Rule ID	Severity	Name
AGENTFORCE-RD-01	🔴 High	Headless Confirmation Bypass (Experience Layer)
AGENTFORCE-RD-03	🔴 High	PII Output Bypass in Headless Transmissions
AGENTFORCE-RD-04	🔴 High	Headless PII Route Validation
AGENTFORCE-RD-02	🟡 Medium	Variable State Condition Evasion

SSRF

Rule ID	Severity	Name
AGENTFORCE-22.1	🚨 Critical	Unsafe Autonomous HTTP Callouts

Security Configuration

Rule ID	Severity	Name
AGENTFORCE-PT-02	🔴 High	Experimental Template Activation Exposure

ServiceNow ACL

Rule ID	Severity	Name
SNOW-28.1	🚨 Critical	ACL Script Using GlideRecord (Recursive Bypass)
SNOW-28.6	🔴 High	addEncodedQuery Without User Context Restriction

ServiceNow API Authentication

Rule ID	Severity	Name
SNOW-24.1	🔴 High	Agent API Endpoint Without OAuth Scope Validation

ServiceNow Agent Architecture

Rule ID	Severity	Name
SNOW-7.1	🟡 Medium	Agent Instruction Bloat

ServiceNow Autonomous Scheduling

Rule ID	Severity	Name
SNOW-11.1	🔴 High	Scheduled Job Invoking Agent Without Guardrail

ServiceNow Data Exfiltration

Rule ID	Severity	Name
SNOW-21.1	🚨 Critical	Agent Script Accessing Sensitive Table Without Privacy Guard

ServiceNow Data Privacy

Rule ID	Severity	Name
SNOW-13.1	🔴 High	Agent Accessing Classified Data Without Privacy Guard

ServiceNow Domain Separation

Rule ID	Severity	Name
SNOW-29.1	🔴 High	Domain Separation Drift (Missing sys_domain)

ServiceNow Excessive Agency

Rule ID	Severity	Name
SNOW-20.1	🚨 Critical	Agent Executing With Admin Privileges

ServiceNow External Service

Rule ID	Severity	Name
SNOW-15.1	🔴 High	Integration Spoke Without Certificate Pinning

ServiceNow Flow Security

Rule ID	Severity	Name
SNOW-5.1	🔴 High	Flow Action Without Input Validation

ServiceNow Grounding Security

Rule ID	Severity	Name
SNOW-3.1	🔴 High	Grounding Source Without Classification

ServiceNow Instruction Integrity

Rule ID	Severity	Name
SNOW-9.1	🚨 Critical	Prompt Injection Vector in Agent Instructions

ServiceNow MCP Access

Rule ID	Severity	Name
SNOW-25.1	🔴 High	MCP Server Without Scope Constraints

ServiceNow MID Server Trust

Rule ID	Severity	Name
SNOW-31.1	🚨 Critical	MID Server / Discovery Trust Violation

ServiceNow Memory Safety

Rule ID	Severity	Name
SNOW-12.2	🚨 Critical	Latent Memory Poisoning in Agent Memory

ServiceNow Multi-Agent

Rule ID	Severity	Name
SNOW-18.1	🔴 High	Multi-Agent Compositional Fragment Trap

ServiceNow Operational Reliability

Rule ID	Severity	Name
SNOW-10.1	🔴 High	Agent DML Without Data Policy Guard

ServiceNow Resource Exhaustion

Rule ID	Severity	Name
SNOW-23.1	🔴 High	Unbounded GlideRecord Query in Agent Script

ServiceNow Role-Based Access

Rule ID	Severity	Name
SNOW-16.1	🔴 High	Agent Action Without Role Gate

ServiceNow Runtime Drift

Rule ID	Severity	Name
SNOW-27.1	🚨 Critical	Now Assist API Confirmation Bypass

ServiceNow SSRF

Rule ID	Severity	Name
SNOW-22.1	🚨 Critical	SSRF via Dynamic RESTMessageV2 Endpoint

ServiceNow Scope Hygiene

Rule ID	Severity	Name
SNOW-30.1	🔴 High	Application Scope Hygiene Violation

ServiceNow Script Safety

Rule ID	Severity	Name
SNOW-2.1	🚨 Critical	Unsafe Script Pattern in Agent Tool

ServiceNow Skill Kit

Rule ID	Severity	Name
SNOW-12.1	🔴 High	Skill Kit Version Drift

ServiceNow Structural Dependency

Rule ID	Severity	Name
SNOW-4.1	🔴 High	Orphaned Agent Tool Reference

ServiceNow Supply Chain

Rule ID	Severity	Name
SNOW-6.1	🔴 High	Update Set Missing Agent Dependencies
SNOW-26.1	🔴 High	Skill Namespace Shadowing

ServiceNow Tool Configuration

Rule ID	Severity	Name
SNOW-1.1	🚨 Critical	Agent Tool Without Confirmation Gate

ServiceNow Trigger Execution

Rule ID	Severity	Name
SNOW-19.1	🔴 High	Business Rule Triggering Agent Execution

ServiceNow Virtual Agent

Rule ID	Severity	Name
SNOW-14.1	🔴 High	Virtual Agent Topic Without Input Sanitization

Slack Integration Security

Rule ID	Severity	Name
AGENTFORCE-14.1	🔴 High	Slack Channel Bot Without DLP Guard

Structural Dependency

Rule ID	Severity	Name
AGENTFORCE-4.2	🔴 High	Component Deactivation Collision

Supply Chain Security

Rule ID	Severity	Name
AGENTFORCE-SC-01	🚨 Critical	Malicious API Downgrade Injection
AGENTFORCE-SC-02	🔴 High	Silent Schema Desync Exploit
AGENTFORCE-SC-03	🟡 Medium	Managed Package Origin

Supply Chain: ToxicSkills

Rule ID	Severity	Name
AGENTFORCE-TS-01	🚨 Critical	Hidden Instruction in Markdown
AGENTFORCE-TS-02	🔴 High	Base64 Payload in Skill File
AGENTFORCE-TS-03	🔴 High	Zero-Width Unicode Injection

Unauthorized Action

Rule ID	Severity	Name
AGENTFORCE-FLOW-02	🔴 High	Silent State Modification via Flow