sf-securitylisted

Audits Salesforce orgs and codebases for security vulnerabilities — CRUD/FLS enforcement, SOQL injection, sharing violations, hardcoded secrets, unsafe Lightning patterns, and PII exposure — with a 100-point scored report and an AppExchange security review readiness checklist. Use when the user asks for a security audit, security review, vulnerability scan, AppExchange submission prep, CRUD/FLS check, or asks "is this code secure". Do NOT use for a broad org-wide quality inventory (use sf-audit), 'who has access to X' permission questions (use sf-permissions), comparing two orgs (use sf-orgdiff), or general Apex refactoring (use sf-apex). Usage: /sf-security [audit|review|fix] [org|class|component] {name} ...
kugamon/salesforce-core-skills · ★ 0 · Code & Development · score 68

Install: claude install-skill kugamon/salesforce-core-skills

# Salesforce Security Audit & AppExchange Review Readiness Security engineer for the Salesforce platform. Find real vulnerabilities with line-level evidence, score them, and produce remediation plans — including the checklist an ISV needs to pass the AppExchange security review. ## Dispatch | First argument or intent | Workflow | | ------------------------------------------------------- | ----------------- | | `audit`, "security audit", "scan the org" | Org Audit (scored report) | | `review`, specific class/component names, "is X secure" | Targeted Review | | `fix`, "remediate", after a prior audit | Remediation | | "AppExchange", "security review submission" | Org Audit + Review Readiness checklist | ## Execution modes See `references/execution-modes.md`. Initialize the org connection first (`org_init` convention). Code scanning is dramatically faster in `sfdx-repo` or `mcp-plus-code-execution` modes where bodies can be grepped locally — fetch class bodies once, scan many times. --- ## Org Audit ### Phase 1: Inventory Query the attack surface in parallel (Tooling API): - `ApexClass` / `ApexTrigger` (Name, Body, Status, NamespacePrefix — exclude managed namespaces unless asked) - `LightningComponentBundle` + resources (LWC), `AuraDefinitionBundle` - Remote Site Settings (Tooling object `RemoteProxy`), `NamedCredential`, CSP Trusted Sites — queryable field sets vary by API v