skills/kouko/monkey-skills/sf-query/Gen Agent Trust Hub

sf-query

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local shell commands for environment validation and authentication. It specifically uses sf org display to check connectivity and a local script (refresh-auth.sh) within the plugin root to handle OAuth token refreshes.- [EXTERNAL_DOWNLOADS]: The documentation references the salesforce-mcp brew formula and the @salesforce/mcp npm package. These are the official distribution methods for the Salesforce DX MCP server and are recognized as well-known, legitimate sources.- [SAFE]: The skill follows a safe operational workflow by echoing the composed SOQL string to the user for sanity-checking before execution. It also explicitly limits its scope to the run_soql_query tool, which is a read-only data tool that does not support DML or metadata modifications.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 05:06 PM
Security Audit — agent-trust-hub — sf-query