The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes untrusted user data in the form of conversation logs and session traces retrieved from Salesforce Data Cloud. This creates a surface for indirect prompt injection, where malicious instructions within the log data could influence the behavior of the agent performing the analysis.
Ingestion points: Conversation messages (ssot__ContentText__c) and session headers retrieved from Data Cloud.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat processed log data as untrusted.
Capability inventory: Shell execution (Bash) and file system access (Read, Write, Edit, Glob, Grep).
Sanitization: No validation or sanitization is applied to the retrieved message content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill dynamically generates temporary Apex scripts (e.g., /tmp/stdm_find.apex) and executes them against the target Salesforce org using sf apex run. These scripts incorporate variables like session IDs and agent names derived from previous command outputs.
[COMMAND_EXECUTION]: Extensive use of host shell commands, including the Salesforce CLI (sf), python, and jq, to discover org configuration, retrieve metadata, and manipulate JSON data.
[DATA_EXFILTRATION]: The skill accesses and retrieves sensitive production data, including conversational content, session metrics, and variable states from Salesforce Data Cloud. This data is handled within the local project environment and the authenticated org context for the purpose of debugging and optimization.

observing-agentforce