data360-orchestrate

SUSPICIOUS: the skill’s stated Salesforce Data Cloud orchestration purpose is coherent, and most commands are proportionate, but the critical runtime depends on an unspecified external community `sf data360` plugin. Because that plugin’s exact source, version, and verification path are omitted, the main risk is supply-chain trust and credential exposure through an unverified plugin rather than confirmed malicious behavior.

This script is primarily a high-impact supply-chain installer. While the bash fragment itself contains no explicit malware/persistence/exfiltration logic, it fetches a repository whose URL is environment-influencable and then immediately executes installation/build steps (yarn install, npx/tsc, and node manifest generation) and links/runs the resulting plugin (sf plugins link, sf data360 man). Because there is no pinning to a specific revision and no integrity/signature verification in this wrapper, compromise of the repo, a dependency, or the PLUGIN_REPO value can lead to arbitrary code execution on the installing machine during dependency installation/build/verification.