sf-datacloud-act

SUSPICIOUS. The skill’s stated purpose and commands are internally coherent for Salesforce Data Cloud activation work, and there is no direct evidence of hidden exfiltration or overt malware. However, its core functionality depends on an unverifiable third-party community sf data360 plugin that was not confirmed in official Salesforce CLI documentation, and that plugin would receive the user’s authenticated Salesforce context to perform live org mutations. This makes the skill high risk from a supply-chain and credential-forwarding perspective even though the task alignment itself appears legitimate.