Salesforce AI Agentforce Observability

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This Salesforce observability skill matches its stated purpose, but it needs Review because it handles sensitive conversation telemetry with broad Data Cloud access and contains unsafe query/token-handling code paths.

Install only for users who are authorized to view Agentforce production telemetry. Use a dedicated least-privilege Salesforce External Client App, keep JWT keys protected, avoid broad date ranges, store exported Parquet files only in approved secure locations, and treat message content, action payloads, and generation data as sensitive. The token forwarding and SQL interpolation issues should be fixed before use in shared, automated, or production-support workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/datacloud_client.py:274

Finding

Salesforce Bearer Token Can Be Disclosed Through an Unvalidated Pagination URL

Content

View full analysis

Remediation

View remediation

str: trusted = urlparse(self.auth.instance_url) resolved = urlparse(urljoin(self.auth.instance_url, candidate)) if resolved.scheme != "https": raise RuntimeError("Refusing non-HTTPS API URL") trusted_port = trusted.port or 443 resolved_port = resolved.port or 443 if ( resolved.hostname != trusted.hostname or resolved_port != trusted_port or resolved.username is not None or resolved.password is not None ): raise RuntimeError("Refusing cross-origin API URL") return resolved.geturl() ``` ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extractor.py:226

Finding

Unvalidated Session IDs Permit Data 360 SQL Injection

Content

View full analysis

Remediation

View remediation

str: if not SALESFORCE_ID.fullmatch(value): raise ValueError(f"Invalid Salesforce record ID: {value!r}") return value valid_ids = [validate_record_id(value) for value in parent_ids] ids_list = ", ".join(f"'{value}'" for value in valid_ids) ``` If Session Tracing uses another documented identifier format, replace the expression with that exact allowlist rather than permitting general SQL string content. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:35

Finding

Quick Start Installs Mutable, Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as focused on session-trace extraction and Parquet-based analysis, yet the reported behavior expands to general Data Cloud querying, metadata discovery, arbitrary SQL execution, and administrative query lifecycle actions. In this context, that broadens the skill from observability into a general data-access surface, which can expose unrelated datasets, schema information, and enable misuse far beyond the stated user intent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as focused on session-trace extraction and Parquet-based analysis, yet the reported behavior expands to general Data Cloud querying, metadata discovery, arbitrary SQL execution, and administrative query lifecycle actions. In this context, that broadens the skill from observability into a general data-access surface, which can expose unrelated datasets, schema information, and enable misuse far beyond the stated user intent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/filtered-extraction.md (reported line 149)May include surrounding context.

Delete the watermark to reset:

bash

rm ~/.sf/observability/prod/watermark.json
stdm-extract extract-incremental --org prod  # Now extracts last 24h

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 273)May include surrounding context.

python

def _exchange_token(self, assertion: str) -> dict:
        """
        Exchange JWT assertion for access token.

        Args:
            assertion: Signed JWT assertion

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 303)May include surrounding context.

python

def _exchange_token(self, assertion: str) -> dict:
        """
        Exchange JWT assertion for access token.

        Args:
            assertion: Signed JWT assertion

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 311)May include surrounding context.

python

def _exchange_token(self, assertion: str) -> dict:
        """
        Exchange JWT assertion for access token.

        Args:
            assertion: Signed JWT assertion

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth.py (reported line 326)May include surrounding context.

python

def _exchange_token(self, assertion: str) -> dict:
        """
        Exchange JWT assertion for access token.

        Args:
            assertion: Signed JWT assertion

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly instructs users to extract, analyze, and locally store Agentforce session traces, message content, generations, feedback, and Trust Layer results in Parquet files without any prominent privacy, retention, access-control, or redaction guidance. Because these datasets can contain user conversations, model outputs, feedback text, and possible PII or sensitive operational telemetry, normalizing local bulk export without safeguards increases the risk of inadvertent data exposure or mishandling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool restrictions even though its documented workflow references scripts, auth setup, Data 360 APIs, Parquet extraction, and local file handling. In an agent setting, missing scope boundaries can let the skill invoke broader shell, network, file, or environment access than users would reasonably expect, increasing the blast radius for mistakes or prompt-injection-driven misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Session tracing and conversation telemetry can contain sensitive operational data and potentially user content, but the skill text does not warn about sensitivity, minimization, or safe handling. Without explicit cautions, operators may extract, store, or share telemetry too broadly, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and trigger guidance are broad enough that the skill may be invoked for loosely related tasks such as general telemetry, trace analysis, or parquet work, increasing the chance of misrouting user requests. With allow_implicit_invocation enabled, unintended activation can expose the user to irrelevant instructions, tool usage, or data handling paths that were not the best-fit skill for the task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script can export complete session timelines, including message content and step input/output fields, directly to JSON without any masking, redaction, access-control check, or explicit warning about sensitive telemetry. In this observability/debugging context, those fields may contain user prompts, agent responses, tool inputs/outputs, identifiers, or other sensitive business data, so writing them to disk increases the risk of unintended disclosure through local files, sharing, backups, or source-control accidents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The query directly selects raw conversation text (ssot__ContentText__c) from agent interaction records for debugging purposes, which can expose sensitive user prompts, personal data, secrets, or regulated content if run by an operator without adequate access controls or handling guidance. In an observability/debugging skill, this is more dangerous because the explicit purpose is to reconstruct conversations, increasing the likelihood of broad access to sensitive transcripts and downstream copying or export.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The hook unconditionally recommends invoking additional skills, including a remediation/agent-definition skill, even though this package is scoped to observability. In an agentic environment, these suggestions can steer follow-on actions outside the intended trust boundary and nudge the user or orchestrator into making changes rather than just analyzing telemetry.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example parses and prints raw action input and output payloads directly to the console, which can expose sensitive user data, tokens, internal identifiers, or system responses contained in observability traces. In this skill's context, trace and action payloads are especially likely to contain production conversation and tool-call data, so copy-pasting this pattern can lead to accidental data disclosure during debugging or sharing logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The word-frequency example processes raw user message text without any privacy guidance, encouraging direct analysis of conversation content that may include PII, secrets, or confidential business information. In an observability skill focused on agent session traces, the underlying message corpus is likely to be real user traffic, which increases the chance of unintended exposure or inappropriate downstream use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The timeline reconstruction example prints conversation snippets from session messages, directly exposing user/agent content in terminal output where it may be stored in shell history, logs, screenshots, or shared debugging artifacts. Because this skill is specifically for analyzing Agentforce telemetry and session traces, the displayed text may contain sensitive conversations from production environments, making the pattern materially risky.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/auth-setup.md (reported line 20)May include surrounding context.

Step 1: Generate JWT Certificate

bash

# Create directory for JWT keys
mkdir -p ~/.sf/jwt

# Generate private key and self-signed certificate (valid 1 year)

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/auth-setup.md (reported line 31)May include surrounding context.

-out ~/.sf/jwt/YourOrg-agentforce-observability.crt
-subj "/CN=AgentforceObservability/O=YourOrg"

Secure the private key (required - Salesforce rejects world-readable keys)

chmod 600 ~/.sf/jwt/YourOrg-agentforce-observability.key

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/auth-setup.md (reported line 32)May include surrounding context.

-subj "/CN=AgentforceObservability/O=YourOrg"

Secure the private key (required - Salesforce rejects world-readable keys)

chmod 600 ~/.sf/jwt/YourOrg-agentforce-observability.key

text

### Step 2: Create External Client App

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/auth-setup.md (reported line 214)May include surrounding context.

-subj "/CN=AgentforceObservability/O=YourOrg"

Secure the private key (required - Salesforce rejects world-readable keys)

chmod 600 ~/.sf/jwt/YourOrg-agentforce-observability.key

text

### Step 2: Create External Client App

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/auth-setup.md (reported line 149)May include surrounding context.

md

| File | Location | Description |
|------|----------|-------------|
| Private Key | `~/.sf/jwt/{org}-agentforce-observability.key` | RSA private key (chmod 600) |
| Certificate | `~/.sf/jwt/{org}-agentforce-observability.crt` | X.509 cert uploaded to Salesforce |
| Consumer Key | `$SF_CONSUMER_KEY` or `--consumer-key` | From ECA OAuth Settings |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/auth-setup.md (reported line 233)May include surrounding context.

md

| File | Location | Description |
|------|----------|-------------|
| Private Key | `~/.sf/jwt/{org}-agentforce-observability.key` | RSA private key (chmod 600) |
| Certificate | `~/.sf/jwt/{org}-agentforce-observability.crt` | X.509 cert uploaded to Salesforce |
| Consumer Key | `$SF_CONSUMER_KEY` or `--consumer-key` | From ECA OAuth Settings |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples repeatedly demonstrate extracting production STDM/session telemetry to local parquet files using a prod org alias, but they do not warn that this data may contain sensitive conversation content, metadata, or regulated information. In an observability skill, normalizing local export of production traces without handling guidance increases the chance of insecure storage, accidental sharing, or retention beyond policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly reverse-engineers an internal Builder trace endpoint and provides operational details for accessing real-time telemetry outside the stated STDM/Data Cloud scope. Even if intended for observability, documenting internal, unsupported interfaces increases the chance of misuse, bypasses normal product boundaries, and exposes richer execution data than officially supported channels.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.