The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing the Salesforce CLI (sf) via npm from the official @salesforce/cli package, which is a well-known service from a recognized vendor.
[COMMAND_EXECUTION]: It relies on the sf CLI for all operations, involving direct execution of system commands for org management and metadata deployment.
[REMOTE_CODE_EXECUTION]: Provides functionality to execute Apex code on Salesforce cloud infrastructure via sf apex run. While executed remotely, it allows the agent to run arbitrary logic within the authenticated CRM context.
[DATA_EXFILTRATION]: The skill is designed to handle sensitive CRM data (PII and financial records). While it includes guardrails against piping this data to network commands, the agent retains full read access to these datasets.
[CREDENTIALS_UNSAFE]: The command sf org display --verbose is documented to output sensitive authentication tokens (refresh tokens) and Sfdx Auth URLs, which would be exposed within the agent's context and session logs.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection when reading data from Salesforce objects.
Ingestion points: Data retrieved from the CRM via sf data query, sf data search, sf data get record, and sf api request rest.
Boundary markers: Absent; there are no instructions to use delimiters or specific ignore-tags when processing retrieved data.
Capability inventory: High-impact tools are available, including sf data delete, sf data update, sf apex run, and sf project deploy.
Sanitization: Absent; the skill does not specify any validation or sanitization steps for data retrieved from the CRM before it is used to drive subsequent agent actions.

salesforce-hardened