The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/pre_score.py utilizes the importlib library to dynamically load and execute Python modules from computed relative paths. Specifically, it imports validators from sibling skill directories (sf-apex, sf-flow, and sf-lwc). While this is used for orchestration, dynamic loading of code from external paths is a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection due to its core functionality.
Ingestion points: The skill ingests untrusted metadata directly from the Salesforce org, including Apex class bodies, Flow XML definitions, and validation rule formulas, via the Tooling API and SOQL queries.
Boundary markers: There are no explicit delimiters or protective instructions provided to the agent to distinguish between metadata content and its own instructions during the scoring phase.
Capability inventory: The skill possesses extensive capabilities, including executing shell scripts (scripts/extract_data.sh), running Python orchestrators, and performing broad filesystem writes within the audit_output directory.
Sanitization: The retrieved metadata is not sanitized or escaped before being presented to the scoring logic.
[COMMAND_EXECUTION]: The skill automates complex data extraction by executing an included shell script (scripts/extract_data.sh). This script performs numerous subprocess calls to the Salesforce CLI (sf) and handles data returned from the org, which is then processed by Python logic.

sf-audit