sf-query
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands for environment validation and authentication. It specifically uses
sf org displayto check connectivity and a local script (refresh-auth.sh) within the plugin root to handle OAuth token refreshes.- [EXTERNAL_DOWNLOADS]: The documentation references thesalesforce-mcpbrew formula and the@salesforce/mcpnpm package. These are the official distribution methods for the Salesforce DX MCP server and are recognized as well-known, legitimate sources.- [SAFE]: The skill follows a safe operational workflow by echoing the composed SOQL string to the user for sanity-checking before execution. It also explicitly limits its scope to therun_soql_querytool, which is a read-only data tool that does not support DML or metadata modifications.
Audit Metadata