The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains various adversarial payloads (e.g., base64 encoded overrides and jailbreak attempts) within the assets/payloads directory. These are explicitly defined as test cases for evaluating the security posture of Agentforce agents and are not intended to influence the agent executing the skill.
[CREDENTIALS_UNSAFE]: The skill provides instructions for extracting temporary Salesforce access tokens using the 'sf org display' command. This credential is used to perform legitimate REST API calls for testing Flow and Apex actions. The skill includes mandatory safety checks that require the target environment to be a sandbox and warns against the use of real PII.
[COMMAND_EXECUTION]: The skill relies on standard command-line utilities (sf CLI, curl, jq, python3) to interact with the Salesforce platform. These tools are used appropriately for their intended purposes within a developer workflow.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it ingests untrusted utterances and test specifications to probe other agents. This risk is inherent to its primary purpose as a security testing tool.
Ingestion points: Test specifications (YAML) and user-supplied utterances passed to 'sf agent preview'.
Boundary markers: The skill contains instructions for the AI to treat input as data rather than commands and emphasizes user confirmation before generating or running adversarial tests.
Capability inventory: Access to the bash shell, the Salesforce CLI, and curl for network interactions.
Sanitization: Employs Python-based sanitization to strip control characters from CLI output to ensure safe JSON parsing.

agentforce-test