The Agent Skills Directory

[SAFE]: The skill provides legitimate templates and scripts for Salesforce development. The shell and Python scripts (run_validation.sh, validate_metadata.py, generate_permission_set.py) perform local file analysis and XML generation using standard libraries, with no evidence of malicious intent or unauthorized actions.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes Salesforce metadata XML files provided by the user, which constitutes an ingestion surface for untrusted data. This is appropriate for the skill's purpose and mitigated by structural parsing and safety-oriented validation logic.\n
Ingestion points: User-managed Salesforce metadata files (e.g., .object-meta.xml, .field-meta.xml) are read by the validate_metadata.py and generate_permission_set.py scripts.\n
Boundary markers: The scripts utilize xml.etree.ElementTree for structured parsing, ensuring a clear boundary between the data content and the skill's execution logic.\n
Capability inventory: The skill facilitates local metadata creation and provides instructions for the official Salesforce CLI (sf).\n
Sanitization: The validate_metadata.py script proactively scans metadata for sensitive data patterns such as SSNs, passwords, and tokens, providing a security-focused audit of the user's files.

sf-metadata