salesforce-developer
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides documentation for CI/CD workflows that include downloading the Salesforce CLI from 'developer.salesforce.com'. This is a well-known and official service provided by Salesforce for developer tooling.
- [COMMAND_EXECUTION]: The documentation includes standard Salesforce CLI (sf) commands for authentication, scratch org management, and metadata deployment. These are standard developer operations and do not include any suspicious or high-risk command patterns.
- [REMOTE_CODE_EXECUTION]: Example scripts for CI/CD pipelines use standard tools like 'wget' and 'tar' to install the Salesforce CLI. These operations are restricted to the environment where the user would run their pipeline and target official binaries.
- [INDIRECT_PROMPT_INJECTION]: As a developer skill, it interprets code and metadata. The documentation mitigates risks by explicitly teaching and requiring sanitization techniques, such as using 'String.escapeSingleQuotes' for dynamic SOQL and 'WITH SECURITY_ENFORCED' for database operations to prevent injection and unauthorized data access.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs users to avoid hardcoding credentials, instead demonstrating the use of Named Credentials and Environment Variables (secrets) in CI/CD contexts.
Audit Metadata