007
無料Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
日本語の概要は準備中です。原文の説明を表示しています。
aibot88/sec_skill_store42026年5月27日 更新
無料GitHub で公開
agent-security-review
Pre-production security checklist for Agentforce deployments: permission scope, data exposure, authentication, logging. NOT for general Salesforce security review (see security-health-check).
含まれるファイル（2）
- SKILL.md4.0 KB
- source.json740 B
SKILL.md（原文）
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Agent Security Review
Agentforce agents touch user PII, internal data, and external APIs with the permissions of whatever user invokes them. A structured review covers four axes: (1) least-privilege user, (2) data classification of every grounding source, (3) action write-scope, (4) audit trail completeness.
When to Use
Any agent before first production activation; any time channel, persona, or Invocable list changes materially; quarterly for long-lived agents.
Typical trigger phrases that should route to this skill: agent go-live security checklist, review what data the agent can see, does the agent leak pii, quarterly agentforce audit.
Recommended Workflow
- Export the agent: topic instructions, Invocable actions, grounding DMOs/sObjects, channel configs. Checksum and archive.
- Map the agent's run-as user to a dedicated permission set; verify no profile-level permissions leak through.
- Classify every grounding source: public, internal, confidential, regulated. Redact/mask confidential+regulated fields at the Trust Layer.
- Enumerate Invocable write scope: which sObjects/fields can be created/updated/deleted. Apply FLS + CRUD checks in Apex; tighten or split the user.
- Verify audit trail: every Invocable logs to
Agent_Audit__c; every conversation is retained per retention policy; Shield Event Monitoring streams cover ApexExecution + ContentTransfer.
Key Considerations
- Default agent-run-as is the invoking user — this is often over-privileged for admin testers. Use automated user for agent invocation.
- Data Cloud grounding can pull data the invoking user cannot see; verify masking at DMO level.
- Invocables bypass
with sharingif written aswithout sharing— audit every action class's sharing declaration. - Audit trail must include prompt + response for forensic replay; conversation storage has retention implications (GDPR).
Worked Examples (see references/examples.md)
- Write-scope tightening — Service agent can 'Update any Case field' via a generic UpdateRecord action.
- Regulated-field masking — RAG grounding includes Contact.Social_Security_Number__c.
Common Gotchas (see references/gotchas.md)
- Agent run-as has View All — Agent sees cross-owner records even when user shouldn't.
- Conversation retention unset — GDPR subject request cannot locate conversation logs.
- Shield Event Monitoring not streamed — Agent anomaly is invisible to SOC.
Top LLM Anti-Patterns (full list in references/llm-anti-patterns.md)
- Running the agent as the invoking user by default — privileged reviewers leak permissions upward.
- Generic 'UpdateRecord' actions — any field becomes attack surface.
- Skipping DMO classification — grounding becomes a data-leak vector.
Official Sources Used
- Agentforce Developer Guide — https://developer.salesforce.com/docs/einstein/genai/guide/agentforce.html
- Einstein Trust Layer — https://help.salesforce.com/s/articleView?id=sf.generative_ai_trust_layer.htm
- Invocable Actions (Apex) — https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_classes_invocable_action.htm
- Agentforce Testing Center — https://help.salesforce.com/s/articleView?id=sf.agentforce_testing_center.htm
レビュー
まだレビューはありません。使ってみた感想をお寄せください。
同じリポジトリのスキル
概要と使いどころ
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
aibot88/sec_skill_store42026年5月27日 更新
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
aibot88/sec_skill_store42026年5月27日 更新
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
日本語の概要は準備中です。原文の説明を表示しています。
aibot88/sec_skill_store42026年5月27日 更新
10x-team
無料You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
日本語の概要は準備中です。原文の説明を表示しています。
aibot88/sec_skill_store42026年5月27日 更新
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
aibot88/sec_skill_store42026年5月27日 更新