The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests production session traces and conversation logs from Salesforce Data Cloud (Phase 1). This data contains untrusted input from end-users which is processed to identify agent failures or regressions. The skill has the capability to modify and publish .agent configuration files (Phase 3), creating a potential path for malicious instructions embedded in session data to influence the agent's logic.
Ingestion points: Conversation messages are retrieved from ssot__AiAgentInteractionMessage__dlm and ssot__AiAgentInteraction__dlm via the AgentforceOptimizeService.cls helper.
Boundary markers: The instructions do not define explicit delimiters or instructions to ignore potential commands embedded within the retrieved conversation logs.
Capability inventory: The skill is granted Bash, Write, and Edit permissions, and performs automated edits to the .agent DSL file followed by sf agent publish commands.
Sanitization: No explicit sanitization or validation of the retrieved session text is performed before it is presented to the agent or used to derive improvement logic.
[COMMAND_EXECUTION]: The skill makes extensive use of the sf CLI to execute arbitrary Apex code via sf apex run. It uses here-docs and temporary files to pipe dynamically generated Apex scripts into the organization to perform data model checks and session queries.
[DYNAMIC_EXECUTION]: The skill includes a custom Apex class, AgentforceOptimizeService.cls, which it deploys to the user's Salesforce organization during Phase 1 setup. This class performs dynamic SOQL and Data Cloud queries to extract internal session telemetry, including LLM prompts and responses.

agentforce-observe