Agent skill · security · jeremylongshore
salesforce-security-basics
Secure a Salesforce integration across OAuth, principals, permissions, sharing, fields, secrets, encryption, logging, and revocation. Use when reviewing threats or hardening controls. Trigger with "secure Salesforce integration".
Why this skill is useful
Provides specific security configurations and practices for Salesforce integrations that the AI wouldn't reliably generate on its own.
What it needs
Requires salesforce account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Salesforce Integration Security Baseline Overview Build a shared-responsibility control set that connects the external application, Salesforce org, principal, data, event, and operational boundaries. Prerequisites System context, data classes, org topology, app type, principal, APIs, events, and support paths Current customer security policy, Salesforce security documentation, and threat model Identity, security, Salesforce administration, privacy, data, application, and incident owners Tool Discipline Use Read, Glob, and Grep to inspect approved repository and evidence files, WebFetch to re-check current first-party Salesforce documentation, and Write or Edit only for secretless plans, fixtures, configuration, and redacted receipts. Current Contract Salesforce access combines OAuth client policy, user or integration-principal permissions, object CRUD, field-level access, record sharing, org settings, and optional security products. Controls and entitlements must be verified in the target org. Authentication Prefer an External Client App for new REST integrations where the org contract requires it, or govern an approved existing Connected App. Use workload-appropriate OAuth, minimum scopes, protected secret custody, rotation, revocation, and no human-password automation. Instructions 1. Map trust boundaries, principals, orgs, APIs, events, data classes, mutations, logs, vendors, and failure paths. 2. Verify app type, OAuth flow, scopes, policies, certificate or secret custody, token lifetime, rotation, and revocation. 3. Review permission sets or groups, profile baseline, CRUD, field access, sharing, elevated access, and separation of duties. 4. Inspect queries, payloads, caches, queues, logs, exports, support bundles, backups, and retention for minimum-data handling. 5. Assess SOQL injection, mass assignment, replay, duplicate mutation, confused-deputy, mixed-org, and secret-exposure threats. 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/salesforce-security-basics--24787c