The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided input (e.g., object names, field names, and access types) and interpolates them directly into SOQL whereClause strings (e.g., SobjectType = '<ObjectName>') and metadata payloads. This creates a vulnerability surface where a malicious user could potentially perform SOQL injection or manipulate metadata operations if the inputs are not properly sanitized by the underlying agent.\n
Ingestion points: User-supplied arguments in SKILL.md (e.g., <ObjectName>, <Access>, <Object.Field>, <ClassName>).\n
Boundary markers: None explicitly mentioned for user-supplied data interpolation.\n
Capability inventory: Includes soql_query, tooling_api_query, metadata_create, metadata_update, metadata_delete, and sobject_dml.\n
Sanitization: The instructions do not specify validation or escaping for the user-supplied strings before use in queries.\n- [COMMAND_EXECUTION]: The skill defines execution modes (sfdx-repo, cli, mcp-plus-code-execution) that explicitly rely on local system command execution (e.g., git log, python3, jq, sf CLI) and file system access to process metadata and reports. While these are intended for local data handling, they represent a broader attack surface than the core MCP mode.\n- [EXTERNAL_DOWNLOADS]: As described in references/mcp-pagination.md, the skill handles large datasets by downloading artifacts from signed URLs (artifactUrl) provided by the MCP server. This is a functional requirement for the Salesforce MCP pagination protocol to manage large response sizes without exhausting context limits.

sf-permissions