platform-docs-get
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The
runtime_bootstrap.pyscript utilizesos.execve()to replace the current process with a Python interpreter from the skill's managed virtual environment located at~/.claude/.fetching-salesforce-docs-runtime. Additionally, extraction scripts usepage.evaluate()to execute JavaScript within the browser context to navigate complex Salesforce documentation components. - [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of verified Python packages (
playwright,playwright-stealth) and browser binaries into its isolated local runtime directory during the setup phase. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Salesforce URLs (ingestion points:
extract_help_salesforce.pyandextract_salesforce_doc.py). It implements boundary markers via 'Rejection Rules' inSKILL.mdand uses heuristic cleaning (cleanup_help_text) to sanitize navigation and shell noise, reducing the risk from untrusted documentation content. - [SAFE]: The skill scripts perform strict host validation to ensure that network requests are only directed to official Salesforce-owned domains, preventing the skill from being misused for arbitrary web scraping.
Audit Metadata