platform-models-api-configure
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bashto execute a bundled script (scripts/get-orgjwt.sh) and standard CLI tools (curl,jq,sf). The script is used to perform a standard OAuth 2.0 client_credentials flow to obtain an access token from the user's own Salesforce instance. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto interact with the Salesforce Models API (api.salesforce.com) and the user's Salesforce instance URL for authentication. These are trusted destinations within the context of the skill's purpose for a Salesforce-authored skill. - [CREDENTIALS_UNSAFE]: The skill instructs users to store sensitive credentials (
SF_CLIENT_ID,SF_CLIENT_SECRET) in a local file (.orgjwt.env). However, it follows security best practices by explicitly instructing the user to set permissions tochmod 600and add the file to.gitignoreto prevent accidental exposure.
Audit Metadata