The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/bootstrap-plugin.sh and documentation in references/plugin-setup.md automate the installation of a CLI plugin by cloning a repository from https://github.com/Jaganpro/sf-cli-plugin-data360.git and running yarn install. This executes arbitrary code from an unverified external source during the environment setup phase.\n- [REMOTE_CODE_EXECUTION]: Documentation in references/plugin-setup.md recommends an insecure execution pattern where a remote script is fetched via curl and executed directly by the python3 interpreter (curl ... | python3 -). This pattern bypasses local security checks and allows for immediate execution of potentially malicious code from a remote server.\n- [EXTERNAL_DOWNLOADS]: The skill relies on external code and assets hosted by a third-party GitHub user (Jaganpro) who is not affiliated with the primary vendor organization, creating a high-risk supply chain dependency on an unverified entity.\n- [COMMAND_EXECUTION]: The scripts/verify-plugin.sh script executes shell commands using bash -lc which include variable interpolation for the org alias. If this input is not strictly validated, it presents a risk of command injection through the script arguments.\n- [COMMAND_EXECUTION]: The scripts/diagnose-org.mjs script performs multiple shell command executions via spawnSync to probe the environment. Although it uses an argument array, the script is designed to execute commands provided by an external, unverified CLI plugin, the integrity of which cannot be guaranteed.

data360-orchestrate