The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local shell commands including the Salesforce CLI (sf), jq, and node to automate configuration tasks.
Evidence: Use of sf data query, sf project deploy, and sf api request within scripts/verify-and-configure.sh to manage organization state.
Evidence: Subprocess calls in scripts/tests/_bootstrap.py and scripts/tests/test_escalation_contracts.py used exclusively for local contract testing.
[DYNAMIC_EXECUTION]: The skill generates and patches Salesforce XML metadata and Agent Script files at runtime based on user inputs.
Evidence: Template substitution in scripts/verify-and-configure.sh using sed to inject identifiers into flow metadata.
Evidence: Programmatic XML modification in scripts/patch-escalation-surfaces.mjs to enable escalation flags.
Mitigation: All dynamic content is sanitized using xml_escape and validated against strict regex patterns (e.g., DN_RE for DeveloperNames) to prevent injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes potentially untrusted metadata (Agent Scripts) from the target organization.
Evidence: scripts/classify-nga-escalation.mjs scans .agent files to verify the presence of escalation actions.
Mitigation: The analysis logic is hardened by stripping comments (stripComments) and utilizing structured section parsing to ensure reachability is proven per-block, reducing the risk of malicious instructions in comments or prose affecting the verdict.
[SAFE]: Implements a mandatory 'Phase 0' safety guard that blocks execution against production organizations.
Evidence: scripts/verify-and-configure.sh queries Organization metadata (IsSandbox, TrialExpirationDate, OrganizationType) and enforces a safe_to_write check before any DML or deployment occurs.
[SAFE]: The skill is authored by a recognized vendor (forcedotcom) and focuses on intended administrative functionality without any indicators of data exfiltration or credential theft.

service-agentforce-human-escalation-configure