The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes metadata such as connection names, labels, and object schemas retrieved from external Salesforce environments via CLI commands. This creates a potential surface for indirect prompt injection where malicious instructions embedded in the metadata could attempt to influence the agent's subsequent logic.
Ingestion points: Metadata retrieved through sf data360 connection list, sf data360 connection get, and REST API calls to the ssot/connections endpoint.
Boundary markers: The instructions lack explicit delimiters or warnings for the agent to treat external metadata as untrusted content.
Capability inventory: The skill possesses the ability to execute local scripts (node diagnose-org.mjs), perform REST API requests, and modify org configuration via connection create and schema-upsert commands.
Sanitization: No specific sanitization or validation of the retrieved metadata is mentioned before it is processed by the agent.
[COMMAND_EXECUTION]: The skill executes multiple shell commands using the Salesforce CLI (sf) and a local diagnostic script via Node.js. This behavior is expected given the skill's purpose as a management interface for Data Cloud connections.
Evidence: Calls to sf data360, sf api request, and node ~/.claude/skills/orchestrating-datacloud/scripts/diagnose-org.mjs are integrated into the core workflow to inspect, test, and create connections.

connecting-datacloud