The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads external plugin code from an untrusted GitHub repository: https://github.com/Jaganpro/sf-cli-plugin-data360.git.- [REMOTE_CODE_EXECUTION]: The script scripts/bootstrap-plugin.sh performs a git clone of an external repository and immediately executes yarn install and npx tsc. This allows for the execution of arbitrary code defined in the external package's dependencies or build scripts.- [REMOTE_CODE_EXECUTION]: The documentation in references/plugin-setup.md suggests using a piped execution pattern: curl -sSL https://raw.githubusercontent.com/Jaganpro/sf-skills/main/tools/install.py | python3. This allows unverified remote code to run directly in the environment.- [COMMAND_EXECUTION]: The skill uses scripts/verify-plugin.sh and scripts/diagnose-org.mjs to execute system-level shell commands for interacting with the Salesforce CLI (sf). This represents an attack surface for command injection if inputs are not strictly controlled.

data360-orchestrate