platform-metadata-retrieve

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute sf project retrieve start using the system's Bash tool. This is the intended purpose of the skill and represents standard usage of the Salesforce CLI for development. The commands are scoped to metadata retrieval and include proper flags for structured output (--json) and quoting for shell expansion safety. Evidence: sf project retrieve start --source-dir <path> --target-org <alias> --json.- [SAFE_PRACTICE]: The instructions explicitly warn against using the --ignore-conflicts flag without user confirmation to prevent accidental loss of local work. Evidence: ⚠️ Warning: Do not use --ignore-conflicts flag without confirming with the user first. This flag overwrites local files and may result in lost work..- [SAFE_PRACTICE]: The skill correctly enforces project boundaries by noting that --output-dir must be inside the project directory and requires an sfdx-project.json file. Evidence: Command requires sfdx-project.json at repo root and Output directory must be inside the project.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 07:29 PM
Security Audit — agent-trust-hub — platform-metadata-retrieve