The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided business requirements to generate Salesforce code and metadata. This provides an attack surface where malicious requirements could result in the generation of vulnerable code. • Ingestion points: Business requirements in the conversation context (SKILL.md). • Boundary markers: Explicit 'MUST DO' and 'MUST NOT DO' constraints are provided in SKILL.md. • Capability inventory: Writing Apex code, executing SOQL/DML queries via tools, and performing metadata deployments across multiple reference files. • Sanitization: Guidance includes using escapeSingleQuotes for dynamic queries and performing field-level security checks.
[EXTERNAL_DOWNLOADS]: The deployment documentation in references/deployment-devops.md instructs on downloading the Salesforce CLI from developer.salesforce.com.
[COMMAND_EXECUTION]: Numerous shell commands for the Salesforce CLI (sf) are provided for environment setup, deployment, and data management.
[DYNAMIC_EXECUTION]: The skill demonstrates the use of dynamic SOQL and Metadata API deployments, including security advice on preventing SOQL injection in references/soql-sosl.md.
[REMOTE_CODE_EXECUTION]: CI/CD workflows and deployment scripts in references/deployment-devops.md download and execute the Salesforce CLI from a trusted official source.
[METADATA_POISONING]: Automated scanners flagged the documentation URL jeffallan.github.io/claude-skills/skills/platform/salesforce-developer/ in the skill metadata. This is a vendor-owned resource used for documentation and does not impact the skill's code logic.

salesforce-developer