The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several standard command-line tools to perform its tasks:
openssl is used to generate 2048-bit RSA private keys and self-signed X.509 certificates in the /tmp directory.
sf (Salesforce CLI) is used to manage org authentication and assign permission sets.
vercel and gh CLIs are used for securely storing generated credentials as environment variables or secrets.
[DYNAMIC_EXECUTION]: The skill generates a temporary Node.js script (/tmp/test_jwt.js) from an embedded template. This script is used to verify the JWT assertion exchange locally before the user commits to storing the credentials in their production environment.
[DATA_EXFILTRATION]: The connectivity test script reads a sensitive RSA private key from /tmp/sf_jwt_server.key and transmits a signed JWT assertion via a POST request to Salesforce's official identity services (login.salesforce.com or test.salesforce.com). This behavior is the intended and standard mechanism for Salesforce JWT authentication and targets a well-known service domain.
[CREDENTIALS_UNSAFE]: The skill handles sensitive information including private keys and consumer secrets. It mitigates risk by:
Explicitly instructing the user to clean up temporary files (rm -f /tmp/sf_jwt_server.key).
Recommending industry-standard secret management via Vercel Environment Variables and GitHub Secrets.
Using placeholders for all sensitive values in documentation examples.

arc-sf-jwt-bearer