dx-pkg-post-install-configure
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the official Salesforce CLI (
sf) to interact with the environment. This is standard and expected behavior for a Salesforce development tool. Execution includes org discovery, data queries, and metadata deployment. - [EXTERNAL_DOWNLOADS]: The skill can fetch package documentation from external URLs using
WebFetch. This is a core part of its functionality to parse post-install instructions. The skill uses neutral language and requires the user to provide the documentation path. - [DATA_EXPOSURE]: The skill reads organization metadata and package installation status to determine the appropriate configuration path. All operations are performed within the context of the authenticated user's permissions.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external post-install documents (PDF, markdown, URLs). It mitigates this risk by extracting discrete steps and presenting them to the user for validation and approval before any execution occurs.
Audit Metadata