Agent skill · software engineering · github
salesforce-apex-quality
Apex code quality guardrails for Salesforce development. Enforces bulk-safety rules (no SOQL/DML in loops), sharing model requirements, CRUD/FLS security, SOQL injection prevention, PNB test coverage (Positive / Negative / Bulk), and modern Apex idioms. Use this skill when reviewing or generating Apex classes, trigger handlers, batch jobs, or test classes to catch governor limit risks, security gaps, and quality issues before deployment.
Why this skill is useful
Provides specific Apex coding standards and patterns that enhance security and performance, which the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Salesforce Apex Quality Guardrails Apply these checks to every Apex class, trigger, and test file you write or review. Step 1 — Governor Limit Safety Check Scan for these patterns before declaring any Apex file acceptable: SOQL and DML in Loops — Automatic Fail Rule: if you see [SELECT or Database.query, insert, update, delete, upsert, merge inside a for loop body — stop and refactor before proceeding. Step 2 — Sharing Model Verification Every class must declare its sharing intent explicitly. Undeclared sharing inherits from the caller — unpredictable behaviour. Declaration When to use --- --- public with sharing class Foo Default for all service, handler, selector, and controller classes public without sharing class Foo Only when the class must run elevated (e.g. system-level logging, trigger bypass). Requires a code comment explaining why. public inherited sharing class Foo Framework entry points that should respect the caller's sharing context If a class does not have one of these three declarations, add it before writing anything else. Step 3 — CRUD / FLS Enforcement Apex code that reads or writes records on behalf of a user must verify object and field access. The platform does not enforce FLS or CRUD automatically in Apex. Rule: any Apex method callable from a UI component, REST endpoint, or @InvocableMethod must enforce CRUD/FLS. Internal service methods called only from trusted contexts may use with sharing instead. Step 4 — SOQL Injection Prevention Step 5 — Modern Apex Idioms Prefer current language features (API 62.0 / Winter '25+): Old pattern Modern replacement --- --- if (obj != null) { x = obj.Fieldc; } x = obj?.Fieldc; x = (y != null) ? y : defaultVal; x = y ?? defaultVal; System.assertEquals(expected, actual) Assert.areEqual(expected, actual) System.assert(condition) Assert.isTrue(condition) [SELECT ... WHERE ...] with no sharing context [SELECT ... WHERE ... …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/salesforce-apex-quality