apex-debug-performance
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the system command
rg(ripgrep) to search through local log files for specific performance-related patterns. - [COMMAND_EXECUTION]: It invokes the Salesforce CLI with a vendor-specific plugin (
sf electivus) to synchronize and check the status of org logs. - [EXTERNAL_DOWNLOADS]: The skill references and utilizes tools from the Certinia Debug Log Analyzer MCP (hosted at
github.com/certinia/debug-log-analyzer-mcp). Certinia is a well-known Salesforce ecosystem provider, and the reference is for legitimate performance profiling capabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes external log data which could contain attacker-influenced strings.
- Ingestion points: The agent reads local Apex log files (
.log) which record system activity and user-supplied data. - Boundary markers: The instructions do not specify explicit delimiters for the log content, though they advise sharing only relevant excerpts.
- Capability inventory: The skill can execute search commands (
rg), CLI operations (sf), and specialized profiling tools (apexlog_*). - Sanitization: There is no explicit sanitization step for the log data before processing.
Audit Metadata