Salesforce AI Agentforce Observability

Agentforce session tracing extraction and analysis. TRIGGER when: user extracts STDM data from Data Cloud, analyzes agent session traces, debugs agent conver...

This skill appears to implement the observability functionality it promises, but the package is poorly packaged: it includes many Python scripts and explicit auth requirements (JWT/cert and Data Cloud scopes) yet the registry metadata declares no credentials or install steps. Before installing or running: - Review scripts/auth.py and scripts/datacloud_client.py to confirm exactly which credentials, files, and endpoints are used and that all network calls target Salesforce Data Cloud endpoints. - Prepare a dedicated, least-privilege connected app / JWT keypair for this purpose (scopes: cdp_query_api, cdp_profile_api). Do NOT use high-privilege or unrelated org credentials. - Run the code in an isolated environment (virtualenv/container) and install only the declared dependencies from CREDITS.md via pip to avoid supply-chain surprises. - Because the package omits declared env vars, check whether the code reads credentials from unexpected locations (env vars, home directory paths). Ensure private keys/certs are stored with appropriate permissions and not world-readable. - If you allow the agent to invoke the skill autonomously, restrict which principals can trigger it (or require user confirmation) because autonomous execution + org credentials increases risk. If you want me to, I can inspect the full contents of scripts/auth.py and scripts/datacloud_client.py to identify exactly where credentials are loaded and which remote endpoints are called; that would materially increase confidence in this assessment.

Type: OpenClaw Skill Name: sf-ai-agentforce-observability Version: 1.0.0 The skill bundle provides a comprehensive toolset for extracting and analyzing Salesforce Agentforce session telemetry. However, it contains significant security vulnerabilities: scripts/datacloud_client.py and scripts/extractor.py construct SQL queries using unsanitized string formatting (f-strings), which is a classic SQL injection vector. Additionally, scripts/auth.py uses subprocess.run to execute Salesforce CLI commands with the org_alias parameter, posing a potential command injection risk if the alias is user-controlled. While these appear to be unintentional design flaws rather than intentional malware, they meet the criteria for a suspicious classification due to high-risk vulnerabilities.