platform-metadata-retrieve
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
sf project retrieve startusing the system's Bash tool. This is the intended purpose of the skill and represents standard usage of the Salesforce CLI for development. The commands are scoped to metadata retrieval and include proper flags for structured output (--json) and quoting for shell expansion safety. Evidence:sf project retrieve start --source-dir <path> --target-org <alias> --json.- [SAFE_PRACTICE]: The instructions explicitly warn against using the--ignore-conflictsflag without user confirmation to prevent accidental loss of local work. Evidence:⚠️ Warning: Do not use --ignore-conflicts flag without confirming with the user first. This flag overwrites local files and may result in lost work..- [SAFE_PRACTICE]: The skill correctly enforces project boundaries by noting that--output-dirmust be inside the project directory and requires ansfdx-project.jsonfile. Evidence:Command requires sfdx-project.json at repo rootandOutput directory must be inside the project.
Audit Metadata