Agent skill · forcedotcom
dx-apexguru-scan
Run an ApexGuru performance scan on a Salesforce Apex project via the ApexGuru SFAP Scan API. Zips the project's Apex (any layout), submits it, polls to completion, decodes the base64 report, and presents performance antipattern violations (SOQL in loop, DML in loop, Schema.getGlobalDescribe(), SOQL without WHERE/LIMIT, unused SOQL fields) grouped by rule with severity, file:line, and suggested fixes — clearly attributed as 'Static only' or 'Production insights'. TRIGGER when the user says 'run ApexGuru', 'ApexGuru scan', 'check Apex performance', 'find governor-limit / performance antipatterns', 'SOQL in loop', 'scan my Apex for performance', or 'ApexGuru performance insights'. DO NOT TRIGGER for general static analysis or security scans (use dx-code-analyzer-run), for fixing code without scanning, or for onboarding an org to ApexGuru.
What it needs
About 12k tokens when loaded.
What this skill does
ApexGuru Performance Scan Skill CRITICAL: Mandatory Script Usage Every step — token resolution, zipping, API calls, and report decoding — MUST go through the bundled scripts in <skilldir>/scripts/. No exceptions. WRONG — never do this: RIGHT — always do this: The three underlying scripts still exist and scan.sh calls them in order. Invoke them individually only for drill-downs on an already-scanned result (Step 5), or when you deliberately need to inspect an intermediate artifact: <skilldir> is the absolute path to the directory containing this SKILL.md. Never use ./scripts/ — that resolves against the user's CWD, not the skill dir. Any filter/rank/group question ("which file has the most issues?", "show only SOQL-in-loop", "break down by severity") is answered by re-running decode-report.js with flags against the same raw result file — never re-scan, never parse the JSON by hand. --- CRITICAL: Present --present output verbatim — never condense it decode-report.js --present (Step 4) already produces the final, ready-to-show markdown: severity legend, one detail card per violation (message, code, fix, resource link), and a closing summary table. That stdout is the response. Print it to the user exactly as printed — do not rewrite it into a shorter table, do not drop the per-issue cards down to just the summary table, and do not wait for the user to ask "explain a violation" before including message/fix/resource. Condensing it defeats the entire point of --present. The attribution is already in that stdout — the summary line is the exact output that states the mode (e.g. "ApexGuru (static analysis) is active. To unlock runtime intelligence…"). Do NOT prepend or append your own attribution sentence (no "Attribution: analysisMode: static…", no naming the org, no restating "static-only findings"). The script's line is the complete, approved wording; adding your own makes the output non-deterministic and off-message. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills forcedotcom/dx-apexguru-scan