sf-datacloud
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation in
references/plugin-setup.mdsuggests an installation pattern that fetches a setup script from a remote URL and pipes it directly to the Python interpreter (curl ... | python3). This is identified as a vendor-managed installation path for the required CLI runtime. - [EXTERNAL_DOWNLOADS]: The
scripts/bootstrap-plugin.shscript clones the plugin source code from the author's GitHub repository and usesyarn installto download necessary dependencies during the environment setup phase. - [COMMAND_EXECUTION]: Multiple scripts, including
scripts/bootstrap-plugin.sh,scripts/verify-plugin.sh, andscripts/diagnose-org.mjs, execute shell commands to interact with the Salesforce CLI (sf) and manage local plugin linking. These operations are restricted to the intended purpose of configuring the Data Cloud development environment.
Audit Metadata