Agent skill · software engineering · jeremylongshore
salesforce-policy-guardrails
Gate Salesforce code and configuration for SOQL injection, secret exposure, unsafe API versions, missing access checks, destructive writes, and unreviewed org changes. Use when running CI or review. Trigger with "add Salesforce guardrails".
Why this skill is useful
Adds executable scripts for SOQL injection prevention and credential leak detection that enhance Salesforce integration security.
What it needs
Requires eslint, jsforce installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Salesforce Integration Policy Guardrails Overview Turn recurring integration hazards into deterministic checks with fail-closed severity, exact evidence, owned exceptions, and no secret-dependent fork execution. Prerequisites Repository, Salesforce DX or adapter layout, languages, CI trust model, protected branches, and code owners Current API EOL, OAuth, security, object and field access, sharing, limits, and deployment contracts Policy authority, severity model, baseline findings, exception format, expiry, and remediation owners Tool Discipline Use Read, Glob, and Grep to inspect approved repository and evidence files, WebFetch to re-check current first-party Salesforce documentation, and Write or Edit only for secretless plans, fixtures, configuration, and redacted receipts. Current Contract Salesforce requires parameter-safe query construction and layered authorization, while supported API versions and client-app guidance evolve. Static rules cannot prove runtime CRUD, field access, sharing, limits, or org identity and must be paired with protected tests. Authentication Static and fixture gates must run without Salesforce credentials. Protected runtime checks use a minimum non-production principal only after exact-head trust and must never expose secrets to fork code. Instructions 1. Inventory query construction, credentials, app and OAuth settings, API versions, objects and fields, mutations, events, retries, logs, and deployment paths. 2. Define checks for string-built SOQL, secrets, unsafe logs, retired or fixed versions, broad scopes, wrong-org defaults, and unrestricted queries. 3. Add rules for missing CRUD and field-access evidence, destructive operations, blind retries, unbounded concurrency, checkpoint resets, and reconciliation gaps. 4. Create positive and negative fixtures for every rule and pin scanners, actions, runtimes, dependencies, and rule hashes. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/salesforce-policy-guardrails