New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Salesforce Policy Guardrails

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Gate Salesforce code and configuration for SOQL injection, secret exposure, unsafe API versions, missing access checks, destructive writes, and unreviewed org changes.

MITAuto-check passedSales & Support

Install Salesforce Policy Guardrails

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill salesforce-policy-guardrails -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace salesforce-policy-guardrails --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/salesforce-policy-guardrails .claude/skills/salesforce-policy-guardrails && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
salesforce-policy-guardrails
GitHub stars
2.8k
Token cost
~1.1k tokens
SKILL.md length
444 words
Files
1
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Gate Salesforce code and configuration for SOQL injection, secret exposure, unsafe API versions, missing access checks, destructive writes, and unreviewed org changes.

  • Works in 7 steps: Inventory query construction,… → Define checks for string-built SOQL,… → Add rules for missing CRUD and… → …
  • With add Salesforce guardrails
  • SKILL.md covers Overview, Prerequisites, Tool Discipline and Current Contract, plus 8 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Salesforce Policy Guardrails is an agent skill from jeremylongshore/tons-of-skills-marketplace. Gate Salesforce code and configuration for SOQL injection, secret exposure, unsafe API versions, missing access checks, destructive writes, and unreviewed org changes. Use when running CI or review. Trigger with "add Salesforce guardrails".

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Designed for Claude Code; blocking policy and exceptions require code, security, Salesforce platform, and business-owner governance

It sits in Sales & Support, covering CRM management and LLM guardrails. It works with Salesforce. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • With add Salesforce guardrails
  • Tasks that involve CRM management
  • Tasks that involve LLM guardrails

Example prompts

  • “add Salesforce guardrails”
  • “/salesforce-policy-guardrails”

Requirements

  • Compatibility (from SKILL.md): Designed for Claude Code; blocking policy and exceptions require code, security, Salesforce platform, and business-owner governance
  • Pre-approved tools (allowed-tools): Read, Glob, Grep, WebFetch, Write, Edit

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Inventory query construction, credentials, app and OAuth settings, API versions, objects and fields, mutations, events, retries, logs, and…
  2. Define checks for string-built SOQL, secrets, unsafe logs, retired or fixed versions, broad scopes, wrong-org defaults, and unrestricted…
  3. Add rules for missing CRUD and field-access evidence, destructive operations, blind retries, unbounded concurrency, checkpoint resets, and…
  4. Create positive and negative fixtures for every rule and pin scanners, actions, runtimes, dependencies, and rule hashes.
  5. Run secretless checks on every change and protected org contract checks only in trusted environments.
  6. Ratchet against a reviewed baseline; require exact finding, owner, reason, scope, expiry, and compensating control for exceptions.
  7. Measure escapes and false positives, close expired waivers, and update policies from incidents and Salesforce contract changes.

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Glob
    • Grep
    • WebFetch
    • Write
    • Edit

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • developer.salesforce.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code; blocking policy and exceptions require code, security, Salesforce platform, and business-owner governance

    From compatibility in the SKILL.md frontmatter.

Context cost

Salesforce Policy Guardrails loads about 1.1k tokens when it runs. Until then it costs about 67 tokens; SKILL.md has 444 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~67
When it runs · the whole SKILL.md, loaded when a task matches
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 444 words, ~1,117 tokens.

Download SKILL.mdSave it as .claude/skills/salesforce-policy-guardrails/SKILL.md (or your agent's skills folder).
name
salesforce-policy-guardrails
description
Gate Salesforce code and configuration for SOQL injection, secret exposure, unsafe API versions, missing access checks, destructive writes, and unreviewed org changes. Use when running CI or review. Trigger with "add Salesforce guardrails".
allowed-tools
Read, Glob, Grep, WebFetch, Write, Edit
compatibility
Designed for Claude Code; blocking policy and exceptions require code, security, Salesforce platform, and business-owner governance
argument-hint
[repository] [policy-profile]
version
1.8.0
author
Jeremy Longshore <jeremy@intentsolutions.io>
license
MIT
tags
saas, salesforce, policy, secure-coding, ci
model
inherit
effort
high

Salesforce Integration Policy Guardrails

Overview

Turn recurring integration hazards into deterministic checks with fail-closed severity, exact evidence, owned exceptions, and no secret-dependent fork execution.

Prerequisites

  • Repository, Salesforce DX or adapter layout, languages, CI trust model, protected branches, and code owners
  • Current API EOL, OAuth, security, object and field access, sharing, limits, and deployment contracts
  • Policy authority, severity model, baseline findings, exception format, expiry, and remediation owners

Tool Discipline

Use Read, Glob, and Grep to inspect approved repository and evidence files, WebFetch to re-check current first-party Salesforce documentation, and Write or Edit only for secretless plans, fixtures, configuration, and redacted receipts.

Current Contract

Salesforce requires parameter-safe query construction and layered authorization, while supported API versions and client-app guidance evolve. Static rules cannot prove runtime CRUD, field access, sharing, limits, or org identity and must be paired with protected tests.

Authentication

Static and fixture gates must run without Salesforce credentials. Protected runtime checks use a minimum non-production principal only after exact-head trust and must never expose secrets to fork code.

Instructions

  1. Inventory query construction, credentials, app and OAuth settings, API versions, objects and fields, mutations, events, retries, logs, and deployment paths.
  2. Define checks for string-built SOQL, secrets, unsafe logs, retired or fixed versions, broad scopes, wrong-org defaults, and unrestricted queries.
  3. Add rules for missing CRUD and field-access evidence, destructive operations, blind retries, unbounded concurrency, checkpoint resets, and reconciliation gaps.
  4. Create positive and negative fixtures for every rule and pin scanners, actions, runtimes, dependencies, and rule hashes.
  5. Run secretless checks on every change and protected org contract checks only in trusted environments.
  6. Ratchet against a reviewed baseline; require exact finding, owner, reason, scope, expiry, and compensating control for exceptions.
  7. Measure escapes and false positives, close expired waivers, and update policies from incidents and Salesforce contract changes.
Show full SKILL.md (144 more words)Show less

Approval Boundaries

Do not suppress blockers, broaden globs, add permanent waivers, expose CI secrets, or auto-fix Salesforce org state without policy-owner approval.

Output

Return the policy catalog, authority and hashes, fixture results, findings, baseline delta, exceptions with expiry, protected-test receipt, and owners.

Error Handling

ConditionResponse
Rule flags generated or vendored contentNarrow the rule with an evidence-backed path boundary rather than disabling the category.
Runtime permission cannot be proven staticallyRequire a protected non-production test and label static evidence as incomplete.
Exception has no owner or expiryFail the gate until governance metadata is complete.

Example

A redacted completion receipt might look like this:

text
profile=enterprise; rules=12; fixtures=24-pass; blockers=0; waivers=2-expiring; fork-secrets=0; runtime=protected-pass

Resources

Next Steps

Run the workflow first in the lowest-risk authorized org and preserve its redacted receipt. Schedule a review against the next Salesforce seasonal release and the customer change calendar.

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/.curated/salesforce-policy-guardrails of jeremylongshore/tons-of-skills-marketplace.

Open the folder on GitHubat commit cfae287

Compare with similar skills

Salesforce Policy Guardrails next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Salesforce Policy Guardrails compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Salesforce Policy Guardrails this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.1kAutomated safety check: PassMIT
Salesforce Apex Qualitygithub/awesome-copilot40k1 repos~1.8kAutomated safety check: PassMIT
Service Itsm Agentic Setup Agent Runtime Access Assignforcedotcom/sf-skills1.1k—~5.4kAutomated safety check: NotesApache-2.0
Platform Policy Rule Generateforcedotcom/sf-skills1.1k—~4.8kAutomated safety check: PassApache-2.0
Soql Lib Query Builderbeyond-the-cloud-dev/soql-lib154—~4.3kAutomated safety check: PassMIT
Sf DatacloudJaganpro/sf-skills424—~2.7kAutomated safety check: PassMIT

Similar skills

  • Salesforce Apex Quality

    github/awesome-copilot

    Official

    Apex code quality guardrails for Salesforce development. An agent skill from github/awesome-copilot.

    40k GitHub starsUsed in 1 repo~1.8k tokens
    Sales & SupportAuto-check passed

  • Service Itsm Agentic Setup Agent Runtime Access Assign

    forcedotcom/sf-skills

    Grant a user the runtime permissions an activated ITSM agent's actions need so the actions do not fail on permission errors.

    1.1k GitHub stars~5.4k tokensUpdated yesterday
    Sales & SupportAuto-check: notes

  • Platform Policy Rule Generate

    forcedotcom/sf-skills

    A skill your agent uses when authoring PolicyRuleDefinition and PolicyRuleDefinitionSet metadata XML for Salesforce Data Cloud governance policies, or when editing .policyRuleDefinition /…

    1.1k GitHub stars~4.8k tokensUpdated yesterday
    Sales & SupportAuto-check passed

  • Soql Lib Query Builder

    beyond-the-cloud-dev/soql-lib

    Builds Salesforce SOQL queries using the SOQL Lib fluent builder API (SOQL.cls).

    154 GitHub stars~4.3k tokensUpdated 8 days ago
    Sales & SupportAuto-check passed

  • Sf Datacloud

    Jaganpro/sf-skills

    Salesforce Data Cloud product orchestrator for connect→prepare→harmonize→segment→act workflows.

    424 GitHub stars~2.7k tokensUpdated 5 mo ago
    Sales & SupportAuto-check passed

  • Soql Lib Selector

    beyond-the-cloud-dev/soql-lib

    Creates Salesforce Apex selector classes using the SOQL Lib selector pattern.

    154 GitHub stars~2k tokensUpdated 8 days ago
    Sales & SupportAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated today
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Salesforce Policy Guardrails

What does Salesforce Policy Guardrails do?

Gate Salesforce code and configuration for SOQL injection, secret exposure, unsafe API versions, missing access checks, destructive writes, and unreviewed org changes. Salesforce Policy Guardrails is an agent skill from jeremylongshore/tons-of-skills-marketplace. Gate Salesforce code and configuration for SOQL injection, secret exposure, unsafe API versions, missing access checks, destructive writes, and unreviewed org changes.

When should I use Salesforce Policy Guardrails?

Salesforce Policy Guardrails fits situations like: with add Salesforce guardrails; tasks that involve CRM management; tasks that involve LLM guardrails.

How do I install Salesforce Policy Guardrails in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill salesforce-policy-guardrails -a claude-code`. Or copy the skill folder (skills/.curated/salesforce-policy-guardrails in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/salesforce-policy-guardrails in your project. Claude Code loads it when a task matches its description.

How do I install Salesforce Policy Guardrails in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill salesforce-policy-guardrails -a codex`. Or copy the skill folder (skills/.curated/salesforce-policy-guardrails in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/salesforce-policy-guardrails in your project. Codex loads it when a task matches its description.

Can I use Salesforce Policy Guardrails in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill salesforce-policy-guardrails -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/salesforce-policy-guardrails, .gemini/skills/salesforce-policy-guardrails, .github/skills/salesforce-policy-guardrails and .opencode/skills/salesforce-policy-guardrails in your project.

What does Salesforce Policy Guardrails need to run?

SKILL.md names no scripts, command-line tools or credentials: Salesforce Policy Guardrails is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Glob, Grep, WebFetch, Write, Edit. Compatibility (from SKILL.md): Designed for Claude Code; blocking policy and exceptions require code, security, Salesforce platform, and business-owner governance.

Does Salesforce Policy Guardrails access the network?

SKILL.md names 1 domain. As links in the text: developer.salesforce.com. This is read from the text; nothing was executed.

Is Salesforce Policy Guardrails safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Salesforce Policy Guardrails use?

Salesforce Policy Guardrails is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Salesforce Policy Guardrails use?

About 1.1k tokens (SKILL.md is roughly 4.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Salesforce Policy Guardrails?

Skills that share tags, products or a category with Salesforce Policy Guardrails: Salesforce Apex Quality (github/awesome-copilot, 40k stars), Service Itsm Agentic Setup Agent Runtime Access Assign (forcedotcom/sf-skills, 1.1k stars), Platform Policy Rule Generate (forcedotcom/sf-skills, 1.1k stars) and Soql Lib Query Builder (beyond-the-cloud-dev/soql-lib, 154 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Salesforce Policy Guardrails?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.