Latest release: v0.0.1Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The bundle purpose is Salesforce development/admin assistance, and the visible skills align with that purpose, including diagrams, data operations, observability, and persona design. Some capabilities are inherently high-impact because they involve remote Salesforce data and telemetry.
Instruction Scope
The visible high-impact instructions include scoping prompts such as target org, operation type, date filters, and cleanup guidance. Users should still treat implicit skill routing and CLI examples as requiring review before execution.
Install Mechanism
No install spec or runnable code is supplied for automatic execution; the static scan reported no findings. README developer workflow commands are documentation, not an install-time auto-run mechanism.
Credentials
Salesforce CLI/org aliases and Data 360 authentication are proportionate to the stated Salesforce workflows, but their real-world authority depends on the user's logged-in org and permissions.
Persistence & Privilege
Visible workflows may write user-directed outputs such as generated persona documents or Parquet telemetry datasets, but no hidden background persistence or self-propagation is shown.
Assessment
This bundle appears suitable for Salesforce development/admin users. Before installing or using it, be ready to review any proposed Salesforce CLI command, especially data create/update/delete/export or telemetry extraction. Use non-production orgs where possible, verify target org aliases, keep credentials least-privileged, and protect any exported telemetry or generated files.Verification
Tags
salesforce-plugin
A dedicated plugin wrapper repo for Salesforce agent skills.
This repository is packaged as a Codex bundle plugin and is also intended to be publishable to ClawHub as an OpenClaw-compatible bundle package.
This repo is the plugin-side companion to the upstream skills repo at:
The split is intentional:
salesforce-skillsstays the reusable upstream source of truth forsf-*skillssalesforce-pluginadds plugin-specific wrapper structure:- plugin manifest
- future hooks, commands, and agents
- generated manifests
- plugin-specific routing metadata
- upstream sync workflow
Host compatibility
- Codex reads the bundle from
.codex-plugin/plugin.json - ClawHub / OpenClaw can publish and install a generated bundle artifact rooted at
package.jsonplusopenclaw.bundle.json
The root package.json is intentionally additive packaging metadata. It does not
change the Codex plugin behavior or the shipped Salesforce skills.
Layout
salesforce-plugin/
├── .codex-plugin/plugin.json
├── .agents/plugins/marketplace.json
├── salesforce.md
├── skills/
│ └── sf-*/
│ ├── overlay.yaml
│ ├── upstream/
│ │ └── ...
│ └── SKILL.md
├── scripts/
│ ├── sync_upstream_skills.py
│ ├── build_skills.py
│ ├── build_skill_manifest.py
│ ├── skill_utils.py
│ └── validate.py
├── generated/
├── hooks/
├── commands/
├── agents/
└── tests/
Upstream workflow
- Sync current upstream skills:
python3 scripts/sync_upstream_skills.py
- Rebuild top-level plugin skill outputs:
python3 scripts/build_skills.py
python3 scripts/build_skill_manifest.py
- Build a publishable ClawHub artifact:
python3 scripts/build_clawhub_bundle.py --profile core
The default core profile keeps the plugin Codex-compatible while avoiding the
sync-only files that caused ClawHub bundle publishes to fail in practice. It
includes:
- root bundle manifests and plugin branding assets
- root agent metadata
- each skill's
SKILL.md - each skill's
agents/openai.yaml
Larger profiles are available for testing:
core-assetscore-refs-assetsruntime
At the moment, only the core profile is verified to publish cleanly to
ClawHub for this repo.
- Run stale-build checks:
python3 scripts/build_skills.py --check
python3 scripts/build_skill_manifest.py --check
python3 scripts/validate.py
- Run tests:
pytest -q
pytest --cov=scripts --cov-report=term-missing -q
Current status
- The repo is scaffolded as a plugin root.
- Salesforce skills are synced from the local upstream checkout.
- Generated artifacts are tracked and validated for drift.
- Overlay metadata is intentionally minimal in v1, but the generated manifest now exposes structured routing metadata and prompt fixtures for eval-style checks.
- ClawHub publishing should use the generated
dist/clawhub/core/artifact instead of the full repo root.
