Salesforce

Query Salesforce data and manage sales pipelines using the `sf` CLI. Use for SOQL queries (simple to complex), opportunity pipeline analysis, forecast reporting, data exports, schema exploration, and CRM data operations. Also use for executive workflows like looking up deals by name, finding contact info to email prospects, preparing pipeline reviews, and cross-referencing CRM data with other tools. Triggers on Salesforce, SOQL, pipeline, opportunity, forecast, CRM data, deal lookup, prospect email, account info, or sf CLI questions.

This skill appears to be a normal helper for the Salesforce 'sf' CLI, but before installing or using it: 1) Ensure you have the 'sf' CLI installed and authenticated to the correct Salesforce org (and prefer a sandbox/test org for evaluation). 2) Install the small dependencies used in the examples/scripts (jq, grep) or expect the commands to fail if missing. 3) Recognize that the skill runs CLI queries under your existing 'sf' credentials — it can read and export org data to local files (CSV/JSON/markdown), so only grant it access to an account with appropriate (least) privilege. 4) If you will allow autonomous agent invocation, consider the risk of automatic exports of sensitive CRM data; restrict scope or test manually first. The main actionable fix for the publisher would be to declare required binaries ('sf', 'jq') in the metadata to remove the small metadata inconsistency.

Type: OpenClaw Skill Name: salesforce-dx Version: 1.0.0 The skill bundle is benign. All files, including the `SKILL.md` instructions, are clearly aligned with the stated purpose of interacting with Salesforce via the `sf` CLI for data querying and pipeline management. The `SKILL.md` provides extensive, legitimate examples of `sf` CLI commands, along with standard shell utilities like `grep`, `jq`, and `date` for output processing and file operations (e.g., `> opps.csv`, `-d ./export`). The `scripts/schema-export.sh` is a utility script to generate schema documentation, which is a benign activity. There is no evidence of prompt injection attempts, data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or obfuscation.