sf-datacloud

Pass

Audited by Gen Agent Trust Hub on Apr 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The documentation in references/plugin-setup.md suggests an installation pattern that fetches a setup script from a remote URL and pipes it directly to the Python interpreter (curl ... | python3). This is identified as a vendor-managed installation path for the required CLI runtime.
  • [EXTERNAL_DOWNLOADS]: The scripts/bootstrap-plugin.sh script clones the plugin source code from the author's GitHub repository and uses yarn install to download necessary dependencies during the environment setup phase.
  • [COMMAND_EXECUTION]: Multiple scripts, including scripts/bootstrap-plugin.sh, scripts/verify-plugin.sh, and scripts/diagnose-org.mjs, execute shell commands to interact with the Salesforce CLI (sf) and manage local plugin linking. These operations are restricted to the intended purpose of configuring the Data Cloud development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 28, 2026, 08:00 PM