data360-connect

SUSPICIOUS: The skill’s capabilities largely match its Salesforce Data Cloud connection-management purpose, and data flows appear to stay within Salesforce APIs. The main concern is install/execution trust: it requires an sf data360 plugin and a local helper script without naming, pinning, or verifying the plugin artifact in this file. This is not strongly malicious, but it carries medium risk due to unverifiable dependency details and sensitive connector credential handling.