The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs jsforce, @salesforce/cli, and simple-salesforce. These are well-known, official, or community-standard packages from the NPM and PyPI registries used for Salesforce integration. These downloads from well-known registries are legitimate and expected for the skill's purpose.
[DATA_EXFILTRATION]: The skill demonstrates secure handling of sensitive credentials by recommending the use of environment variables and .env files. It explicitly warns users to add .env to .gitignore to prevent accidental credential leakage in version control, which is a standard security best practice.
[COMMAND_EXECUTION]: The skill uses npm and pip to install the necessary dependencies. These commands are scoped to the intended packages and are standard operations for setting up a development environment for Salesforce integration.
[INDIRECT_PROMPT_INJECTION]: While the skill enables the agent to interact with external data via the Salesforce API, it follows standard SDK patterns. The implementation uses structured SDK methods rather than raw string interpolation of API responses, which helps mitigate risks associated with untrusted data ingestion.

salesforce-install-auth