Salesforce API Integration

Complete Salesforce REST API for SOQL queries, CRUD operations, Bulk API, Composite API, authentication, and standard objects with error handling.

This skill is a coherent Salesforce API guide. Before installing: (1) only provide SF_ACCESS_TOKEN and SF_INSTANCE_URL — avoid exporting long-lived client secrets or passwords as env vars unless you understand the OAuth flow you’re using; (2) review ~/salesforce-api-integration/memory.md after first use — it may store org context or saved queries (but should not store tokens); (3) prefer using the interactive (web server) or refresh-token flows over username/password flows, which require sharing more sensitive credentials; (4) ensure the access token you provide has only the scopes needed for intended operations and rotate it if you suspect exposure. If you need the skill to never persist any org metadata, do not create the memory file or check its contents before use.

Type: OpenClaw Skill Name: salesforce-api-integration Version: 1.0.1 The skill bundle is benign. All `curl` commands across the various markdown files consistently target legitimate Salesforce API endpoints (`*.my.salesforce.com`, `login.salesforce.com`, `test.salesforce.com`) using environment variables `SF_ACCESS_TOKEN` and `SF_INSTANCE_URL`. The `SKILL.md` explicitly defines a narrow and secure scope, disallowing access to files outside `~/salesforce-api-integration/` and requests to non-Salesforce endpoints, which is adhered to by all other files. There is no evidence of data exfiltration, malicious execution (e.g., `curl | bash`), persistence mechanisms, or prompt injection attempts designed to subvert the agent's intended behavior. The `setup.md` file describes various authentication methods, including the username-password flow, but these are instructions for the user to set up their environment variables, not actions performed by the skill itself.