The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Salesforce CLI (sf) extensively to query and update organizational metadata and data records. These commands are executed via the Bash tool as documented in Phase 1 through 7 of the workflow.
The commands are structured and documented in references/cli-invocation.md, focusing on sf data query, sf api request rest, and sf org assign permset.
Arguments for these commands, such as target usernames, are resolved through deterministic scripts (scripts/rank-candidate-users.mjs, scripts/resolve-target-user.mjs) and user input via AskUserQuestion, mitigating the risk of command injection.
[REMOTE_CODE_EXECUTION]: The skill does not perform any remote code execution or download external scripts. All logic is contained within the local Node.js helper scripts provided in the skill package.
[CREDENTIALS_UNSAFE]: The skill explicitly follows a "never extract the access token" rule. It relies on the authenticated session of the Salesforce CLI (--target-org <alias>) to interact with the API, which is a standard and secure practice for Salesforce automation.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (Salesforce records such as User names, Bot definitions, and Permission Set metadata). It uses deterministic JavaScript classifiers to parse these JSON responses rather than relying on the LLM to interpret the raw data, which significantly reduces the attack surface for indirect prompt injection.

service-itsm-agentic-setup-agent-runtime-access-assign