building-sf-integrations
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes several shell scripts (e.g.,
scripts/configure-named-credential.sh,scripts/set-api-credential.sh) designed to automate the configuration of Salesforce credentials. These scripts interact with the Salesforce CLI (sf) to deploy metadata and execute Apex code. Specifically,configure-named-credential.shdynamically generates and runs Apex to store API keys securely within the target org via theConnectApinamespace. - [CREDENTIALS_UNSAFE]: The script
scripts/set-api-credential.shincludes an option to pass API keys as cleartext command-line arguments. While the documentation and the script itself advocate for a secure hidden-input mode using the-flag, the existence of a direct argument mode poses a risk of credential exposure through shell command history. - [SAFE]: The skill features a security validation hook (
hooks/scripts/validate_integration.py) that automatically audits Apex and metadata files for hardcoded secrets (Bearer tokens, API keys, passwords) and checks for architectural best practices, such as the proper use of Named Credentials for HTTP callouts.
Audit Metadata