ClawHub
Back to skill

Security audit

Salesforce Skill

Security checks for vulnerabilities and agentic risk

Overview

This Salesforce skill is mostly purpose-aligned, but it gives an agent broad CRM mutation power and includes credential-revealing commands without enough guardrails.

Install only if you are comfortable letting the agent use an authenticated Salesforce CLI session. Prefer browser login, use least-privileged Salesforce users and sandbox orgs where possible, require explicit confirmation for any write, deploy, Apex, bulk, or raw REST operation, and do not let the agent print or save access tokens, refresh-token auth URLs, or full org display JSON.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The authentication section instructs use of access-token and SFDX auth URL login flows, both of which involve handling highly sensitive bearer credentials. In an agent skill context, documenting these flows without strict guidance on secret input handling, non-logging, redaction, and secure storage can lead to credential capture in files, shell history, telemetry, or model-visible context.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
# JWT-based login (CI/automation)
sf org login jwt --client-id <consumer-key> --jwt-key-file server.key --username user@example.com --alias my-org

# Login with an existing access token
sf org login access-token --instance-url https://mycompany.my.salesforce.com

# Login via SFDX auth URL (from a file)

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill states that sf org display --json exposes the access token, instance URL, and username, and further shows a verbose mode that reveals an SFDX auth URL containing a refresh token. These are reusable credentials; if an agent surfaces them in output or logs, an attacker could gain authenticated access to the Salesforce org and perform data theft, modification, or administrative actions.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
# List all authenticated orgs
sf org list --json

# Display info about the default org (access token, instance URL, username)
sf org display --json

# Display info about a specific org

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly documents sf org display --json and sf org display --verbose --json, noting that the output includes an access token and, in verbose mode, an SFDX auth URL containing a refresh token. Because the skill does not pair these commands with a strong warning not to print, store, or share the output, it increases the risk that users or downstream agents will expose reusable Salesforce credentials in logs, transcripts, or chat responses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.