007
무료Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
무료GitHub에 공개
agent-security-review
Pre-production security checklist for Agentforce deployments: permission scope, data exposure, authentication, logging. NOT for general Salesforce security review (see security-health-check).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
연동 도구Salesforce
설치 방법 보기포함된 파일(2)
- SKILL.md4.0 KB
- source.json740 B
SKILL.md(원문)
설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
Agent Security Review
Agentforce agents touch user PII, internal data, and external APIs with the permissions of whatever user invokes them. A structured review covers four axes: (1) least-privilege user, (2) data classification of every grounding source, (3) action write-scope, (4) audit trail completeness.
When to Use
Any agent before first production activation; any time channel, persona, or Invocable list changes materially; quarterly for long-lived agents.
Typical trigger phrases that should route to this skill: agent go-live security checklist, review what data the agent can see, does the agent leak pii, quarterly agentforce audit.
Recommended Workflow
- Export the agent: topic instructions, Invocable actions, grounding DMOs/sObjects, channel configs. Checksum and archive.
- Map the agent's run-as user to a dedicated permission set; verify no profile-level permissions leak through.
- Classify every grounding source: public, internal, confidential, regulated. Redact/mask confidential+regulated fields at the Trust Layer.
- Enumerate Invocable write scope: which sObjects/fields can be created/updated/deleted. Apply FLS + CRUD checks in Apex; tighten or split the user.
- Verify audit trail: every Invocable logs to
Agent_Audit__c; every conversation is retained per retention policy; Shield Event Monitoring streams cover ApexExecution + ContentTransfer.
Key Considerations
- Default agent-run-as is the invoking user — this is often over-privileged for admin testers. Use automated user for agent invocation.
- Data Cloud grounding can pull data the invoking user cannot see; verify masking at DMO level.
- Invocables bypass
with sharingif written aswithout sharing— audit every action class's sharing declaration. - Audit trail must include prompt + response for forensic replay; conversation storage has retention implications (GDPR).
Worked Examples (see references/examples.md)
- Write-scope tightening — Service agent can 'Update any Case field' via a generic UpdateRecord action.
- Regulated-field masking — RAG grounding includes Contact.Social_Security_Number__c.
Common Gotchas (see references/gotchas.md)
- Agent run-as has View All — Agent sees cross-owner records even when user shouldn't.
- Conversation retention unset — GDPR subject request cannot locate conversation logs.
- Shield Event Monitoring not streamed — Agent anomaly is invisible to SOC.
Top LLM Anti-Patterns (full list in references/llm-anti-patterns.md)
- Running the agent as the invoking user by default — privileged reviewers leak permissions upward.
- Generic 'UpdateRecord' actions — any field becomes attack surface.
- Skipping DMO classification — grounding becomes a data-leak vector.
Official Sources Used
- Agentforce Developer Guide — https://developer.salesforce.com/docs/einstein/genai/guide/agentforce.html
- Einstein Trust Layer — https://help.salesforce.com/s/articleView?id=sf.generative_ai_trust_layer.htm
- Invocable Actions (Apex) — https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_classes_invocable_action.htm
- Agentforce Testing Center — https://help.salesforce.com/s/articleView?id=sf.agentforce_testing_center.htm
리뷰
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
댓글
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
같은 저장소의 스킬
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
10x-team
무료You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트