The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted code (Apex, LWC, Aura) and configuration metadata from Salesforce environments, creating a surface for indirect prompt injection if malicious instructions are embedded in the scanned source code.
Ingestion points: Processes ApexClass, ApexTrigger, LightningComponentBundle, and AuraDefinitionBundle bodies as described in SKILL.md (Phase 1: Inventory).
Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when the agent processes the retrieved code snippets.
Capability inventory: The skill possesses significant capabilities including soql_query, metadata_create, metadata_update, and apex_execute (as defined in references/execution-modes.md), which could be targeted by a successful injection.
Sanitization: No explicit sanitization or filtering of the scanned code's content is mentioned prior to processing.
[EXTERNAL_DOWNLOADS]: In references/execution-modes.md, the skill describes a protocol for 'Artifact download' where it fetches content from an artifactUrl and writes it to the local filesystem. This is a standard mechanism for handling large metadata payloads from Salesforce MCP servers.
[COMMAND_EXECUTION]: The skill relies on several local system commands to function, including the Salesforce CLI (sf), git (for repo mode), and standard utilities like python3 and jq for data processing and scoring.

sf-security