The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The documentation in references/plugin-setup.md recommends a highly insecure execution pattern by piping a remote script directly into Python: curl -sSL https://raw.githubusercontent.com/Jaganpro/sf-skills/main/tools/install.py | python3 -. This allows for arbitrary code execution from a repository that is not a recognized trusted source.
[EXTERNAL_DOWNLOADS]: The scripts/bootstrap-plugin.sh script automates the cloning of an external repository (https://github.com/Jaganpro/sf-cli-plugin-data360.git), installs its dependencies via yarn install, and links the resulting code into the local environment as a Salesforce CLI plugin. This introduces unverified code from a third-party account into the user's execution environment.
[COMMAND_EXECUTION]: The skill includes multiple scripts (scripts/diagnose-org.mjs, scripts/verify-plugin.sh, scripts/bootstrap-plugin.sh) that invoke shell commands and spawn child processes. These scripts handle user-supplied data such as org aliases and file paths, which could lead to command injection if the environment is compromised or if inputs are maliciously crafted.
[PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by ingesting and processing data from external Data Cloud environments.
Ingestion points: Raw output and error messages from sf data360 commands captured in scripts/diagnose-org.mjs (e.g., DMO lists, segment details, and health check results).
Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat this ingested data as untrusted or to ignore instructions embedded within it.
Capability inventory: The skill has significant capabilities, including executing shell commands and mutating Data Cloud assets, which an agent could be manipulated into using via injected instructions.
Sanitization: The scripts do not perform sanitization or validation of the retrieved command outputs before presenting them to the agent context.

orchestrating-datacloud