@raishin/vanguard-frontier-agentic 2.2.0 → 2.5.0

package/skills/salesforce/salesforce-org-assessment-skill/SKILL.md

@@ -0,0 +1,137 @@
+---
+name: salesforce-org-assessment-skill
+description: Use this skill when a Salesforce org's overall posture must be assessed from sanitized exports — covering the object model, automation inventory, permission topology, integration map, and technical debt indicators. Produces a risk register and remediation backlog. Trigger phrases: "assess this Salesforce org", "review org health", "generate a risk register for this org", "what is the technical debt in this org", "review this metadata export for posture". Do not use when you need to review a single metadata type in depth (use salesforce-metadata-review-skill), when you need to review only permissions (use salesforce-permission-model-review-skill), or when a live production change is being proposed (use salesforce-live-change-approval-protocol). Works from sanitized exports only; never requests live org credentials or direct API access.
+allowed-tools: Read Grep Glob
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-05-20"
+  category: platform
+  lifecycle: experimental
+---
+
+# Salesforce Org Assessment Skill
+
+## Purpose
+This skill provides a structured workflow for assessing a Salesforce org's
+overall posture from sanitized metadata exports. It produces a risk register
+and remediation backlog covering the object model, automation inventory,
+permission topology, integration map, and technical debt indicators. It does
+not access live orgs, request credentials, or authorize changes.
+
+## When to use
+- An org is being evaluated for acquisition, merger, or re-platforming.
+- A new technical lead needs a structured health baseline.
+- A security or compliance review requires a documented posture assessment.
+- A risk register must be produced before a major release or migration.
+
+## When not to use
+- Single metadata type deep-dive — use `salesforce-metadata-review-skill`.
+- Permission-only review — use `salesforce-permission-model-review-skill`.
+- Live production change proposal — use `salesforce-live-change-approval-protocol`.
+- Automation-only review — use `salesforce-flow-automation-review-skill`.
+
+## Minimum payload (required inputs)
+- Sanitized metadata exports (one or more of): object definitions, field lists,
+  automation inventory (Flow list, validation rules), permission set/profile
+  summary, installed packages list, integration endpoints (sanitized, no tokens).
+- Org environment type (production / sandbox — use placeholder, not real org ID).
+- Business context: industry vertical, approximate user count range, primary
+  use cases (Sales, Service, Marketing, CPQ, etc.).
+
+## Workflow
+1. **Object model review** — Identify custom objects, junction objects, deprecated
+   standard objects in use, field count per object (flag objects > configurable
+   threshold), hardcoded IDs in default field values, formula complexity.
+2. **Automation inventory** — List all automation types present (Flow, validation
+   rules, approval processes, triggers, Process Builder
+).
+   Flag: mixed automation types on same object, Process Builder still active,
+   missing fault paths, automation running in system context without sharing.
+3. **Permission topology** — Identify profiles, permission sets, permission set
+   groups. Flag: toxic combinations (ModifyAllData, ViewAllData, broad API
+   Enabled without IP restriction). Summarize permission set proliferation.
+4. **Integration map** — List integration patterns present (REST, SOAP, Bulk,
+   Streaming, Platform Events
+, CDC
+, middleware). Flag: point-to-point
+   patterns without error queues, missing named credentials, hardcoded endpoints.
+5. **Technical debt indicators** — Assess: deprecated metadata types, unused
+   fields (> configurable threshold with zero usage), hardcoded IDs, legacy
+   APIs still in use, managed package versions behind current release.
+6. **Risk register** — For each finding, assign: risk_tier (from
+   salesforce-risk-taxonomy), matter_type, remediation_priority, owner_role,
+   estimated_effort.
+7. **Remediation backlog** — Ordered list of remediation items with priority,
+   dependency notes, and recommended approach.
+
+## Evidence requirements
+- Sanitized metadata exports; no credentials, no session tokens, no customer data.
+- If exports contain field values that appear to be production data samples,
+  decline and ask for schema-only exports.
+- Object and field counts are acceptable; record values are not.
+
+## Output format
+```
+org_assessment_summary:
+  object_model_findings: [list with risk_tier per finding]
+  automation_inventory_findings: [list with risk_tier]
+  permission_topology_findings: [list with risk_tier]
+  integration_map_findings: [list with risk_tier]
+  technical_debt_indicators: [list with risk_tier]
+
+risk_register:
+  - finding_id: [generated]
+    matter_type: [from salesforce-risk-taxonomy]
+    risk_tier: Critical | High | Medium | Low | Unknown
+    description: [one sentence]
+    evidence_basis: [what in the export supports this]
+    owner_role: [placeholder role]
+    remediation_priority: P1 | P2 | P3 | P4
+
+remediation_backlog:
+  - priority: [P1-P4]
+    item: [description]
+    dependencies: [other items that must precede this]
+    recommended_approach: [brief]
+
+escalation_gates_fired: [from salesforce-risk-taxonomy, or "none"]
+missing_evidence: [what would improve the assessment]
+assumptions: [explicit list]
+```
+
+## Redaction rules
+- Never request secrets, credentials, OAuth tokens, refresh tokens, session IDs, MFA seeds, customer PII.
+- Sanitize org IDs, user IDs (replace with placeholders) before sharing in outputs.
+- Field default values that appear to be real data must be flagged and excluded from output.
+
+## Privilege / data handling rules
+- Works from schema-level exports only; does not require record-level data.
+- If regulated-vertical indicators are present (Health Cloud, Financial Services
+  Cloud
+), escalate compliance findings
+  to a qualified compliance specialist.
+- Assessment output is internal; do not share org topology details externally.
+
+## Handoff rules
+- Hands off to: salesforce-permission-model-review-skill (permission topology deep-dive),
+  salesforce-flow-automation-review-skill (automation deep-dive),
+  salesforce-metadata-review-skill (metadata type deep-dive),
+  salesforce-integration-review-skill (integration deep-dive).
+- If escalation gate fires: salesforce-case-capsule with escalation_required = true.
+- Required handoff fields: matter_id, risk_register (summary), escalation_gates_fired,
+  missing_evidence, assumptions.
+
+## Audit log fields
+- matter_id, skill_id, skill_version, invoked_by, input_hash, evidence_quality, output_verdict, escalation_fired, timestamp
+
+## Stop conditions
+- Export contains live credentials, session tokens, or record-level PII — stop and ask for sanitized version.
+- Environment type is production and an escalation gate fires — stop and invoke salesforce-case-capsule before continuing.
+- Export is from a regulated-vertical org and jurisdiction is unknown — flag and escalate.
+
+## Security notes
+- Read-only static review; never requests live org access or API credentials.
+- Sanitized inputs only; any input containing credentials must be refused.
+- Risk register is advisory; remediation requires human authorization.
+- Regulated-vertical findings must be escalated to qualified compliance counsel.

package/skills/salesforce/salesforce-org-assessment-skill/metadata.json

@@ -0,0 +1,18 @@
+{
+  "id": "salesforce-org-assessment-skill",
+  "name": "Salesforce Org Assessment Skill",
+  "type": "skill",
+  "provider": "salesforce",
+  "harnesses": ["codex", "claude-code", "cursor", "gemini", "kiro", "other"],
+  "summary": "Structured workflow for assessing a Salesforce org's overall posture from sanitized exports — object model, automation inventory, permission topology, integration map, and technical debt indicators — producing a risk register and remediation backlog.",
+  "source_type": "original",
+  "official_docs": [
+    "https://help.salesforce.com/",
+    "https://developer.salesforce.com/docs"
+  ],
+  "security_notes": "Read-only static review; sanitized exports only; never requests live org credentials, session tokens, or API access. Risk register is advisory; remediation requires human authorization. Regulated-vertical findings escalated to compliance counsel.",
+  "last_verified": "2026-05-20",
+  "path": "skills/salesforce/salesforce-org-assessment-skill",
+  "author": "github: Raishin",
+  "version": "0.1.0"
+}

package/skills/salesforce/salesforce-org-assessment-skill/references/assessment-rubric.md

@@ -0,0 +1,228 @@
+# Assessment Rubric Reference
+
+100-point org posture scoring model across five domains for Salesforce
+org-level health and security assessment.
+
+---
+
+## Scoring Model Overview
+
+| Domain | Max Points | Weight |
+|--------|-----------|--------|
+| Access and Identity | 25 | 25% |
+| Object Model and Metadata | 20 | 20% |
+| Automation and Code Quality | 20 | 20% |
+| Integrations and Callouts | 20 | 20% |
+| Data Integrity and Compliance | 15 | 15% |
+| **Total** | **100** | **100%** |
+
+### Score Interpretation
+
+| Score | Rating | Action |
+|-------|--------|--------|
+| 90-100 | Excellent | Monitor for drift; review annually |
+| 75-89 | Good | Address MEDIUM findings within 90 days |
+| 60-74 | Fair | Address HIGH findings within 30 days; 90-day remediation plan |
+| 40-59 | Poor | Immediate remediation plan; executive escalation |
+| < 40 | Critical | Emergency review; restrict access until remediated |
+
+---
+
+## Domain 1: Access and Identity (25 points)
+
+### 1.1 Multi-Factor Authentication (6 points)
+
+| Check | Points |
+|-------|--------|
+| MFA enforced for all active internal users | 3 |
+| MFA enforced via org-wide policy (not just individual setting) | 2 |
+| MFA required for API-access user accounts | 1 |
+
+**Query:**
+```sql
+SELECT Id, Name, Profile.Name,
+       (SELECT Id FROM UserPreferences WHERE PreferencesIsVerificationEnabled = false)
+FROM User
+WHERE IsActive = true
+  AND UserType = 'Standard'
+LIMIT 500
+```
+
+### 1.2 Admin Account Controls (7 points)
+
+| Check | Points |
+|-------|--------|
+| System Administrator profile users < 5% of total active users | 2 |
+| Named admin accounts (no shared/generic admin logins) | 2 |
+| Admin accounts have login IP restrictions configured | 2 |
+| Emergency access ("break glass") account documented and monitored | 1 |
+
+**Query:**
+```sql
+SELECT COUNT(Id) adminCount
+FROM User
+WHERE Profile.Name = 'System Administrator'
+  AND IsActive = true
+```
+
+### 1.3 Integration User Controls (5 points)
+
+| Check | Points |
+|-------|--------|
+| Dedicated integration user accounts (not shared with humans) | 2 |
+| Integration user profiles have only required permissions | 2 |
+| Integration user credentials rotated within last 90 days | 1 |
+
+### 1.4 Permission Model Health (7 points)
+
+| Check | Points |
+|-------|--------|
+| Modify All Data users documented with business justification | 2 |
+| View All Data users reviewed and minimized | 2 |
+| Custom Permission Sets in use (not all-in-one profiles) | 2 |
+| Guest User profile reviewed and minimal | 1 |
+
+---
+
+## Domain 2: Object Model and Metadata (20 points)
+
+### 2.1 Custom Field Health (5 points)
+
+| Check | Points |
+|-------|--------|
+| Account custom fields < 100 | 2 |
+| Fields unused in 6+ months documented or removed | 2 |
+| External ID fields present on objects synced with external systems | 1 |
+
+### 2.2 Schema Design Quality (8 points)
+
+| Check | Points |
+|-------|--------|
+| Master-detail vs lookup relationships correctly applied | 3 |
+| No hardcoded IDs in custom fields' formula or default values | 2 |
+| Record Types configured per distinct business process (not overloaded) | 2 |
+| Custom object OWD is Private (or Controlled by Parent) | 1 |
+
+### 2.3 Metadata Currency (7 points)
+
+| Check | Points |
+|-------|--------|
+| No active Workflow Rules (all migrated to Flows) | 3 |
+| No active Process Builder processes | 3 |
+| No Apex on API version < 50.0 | 1 |
+
+---
+
+## Domain 3: Automation and Code Quality (20 points)
+
+### 3.1 Apex Code Health (10 points)
+
+| Check | Points |
+|-------|--------|
+| No SOQL in loops detected (PMD scan passing) | 3 |
+| No DML in loops detected | 3 |
+| All classes declare `with sharing` or `without sharing` (no implicit) | 2 |
+| Test coverage > 75% org-wide | 2 |
+
+**Query:**
+```sql
+SELECT PercentCovered
+FROM ApexOrgWideCoverage
+```
+
+### 3.2 Flow Health (6 points)
+
+| Check | Points |
+|-------|--------|
+| All record-triggered flows have fault paths on DML elements | 3 |
+| No DML-in-loop patterns in active flows | 2 |
+| Inactive flows cleaned up (no orphaned inactive versions in production) | 1 |
+
+### 3.3 Governor Limit Exposure (4 points)
+
+| Check | Points |
+|-------|--------|
+| No AsyncApexJob failures in the last 30 days | 2 |
+| No LimitException events in debug logs in the last 7 days | 2 |
+
+```sql
+SELECT COUNT(Id)
+FROM AsyncApexJob
+WHERE Status = 'Failed'
+  AND CreatedDate = LAST_N_DAYS:30
+```
+
+---
+
+## Domain 4: Integrations and Callouts (20 points)
+
+### 4.1 Named Credential Usage (8 points)
+
+| Check | Points |
+|-------|--------|
+| All callouts use Named Credentials (no hardcoded endpoints) | 4 |
+| No Remote Site Settings with DisableProtocolSecurity = true | 4 |
+
+### 4.2 Connected App Security (7 points)
+
+| Check | Points |
+|-------|--------|
+| OAuth Username-Password Flow disabled | 3 |
+| All Connected Apps have IP Relaxation = "Enforce IP Restrictions" | 2 |
+| OAuth token timeouts configured (not unlimited) | 2 |
+
+### 4.3 Integration Resilience (5 points)
+
+| Check | Points |
+|-------|--------|
+| Error handling exists on all `@AuraEnabled` callout methods | 2 |
+| Platform Event or Custom Error Log used for callout failure tracking | 2 |
+| Retry logic exists for transient failures | 1 |
+
+---
+
+## Domain 5: Data Integrity and Compliance (15 points)
+
+### 5.1 Consent Management (5 points)
+
+| Check | Points |
+|-------|--------|
+| Individual object linked to Contacts with email addresses | 2 |
+| ContactPointConsent records present with CaptureDate populated | 2 |
+| Opt-out synced between all connected marketing systems | 1 |
+
+### 5.2 Data Residency and Encryption (5 points)
+
+| Check | Points |
+|-------|--------|
+| Org on Hyperforce (if regulatory data residency required) | 2 |
+| Shield Platform Encryption enabled for PII/PHI fields | 2 |
+| Encryption key rotation schedule documented | 1 |
+
+### 5.3 Audit and Monitoring (5 points)
+
+| Check | Points |
+|-------|--------|
+| Setup Audit Trail exported to SIEM or long-term storage | 2 |
+| Login History retention beyond 6 months configured | 2 |
+| Automated monitoring alert for admin login from new IP | 1 |
+
+---
+
+## Scoring Worksheet
+
+```
+Domain 1 Score: ___ / 25
+Domain 2 Score: ___ / 20
+Domain 3 Score: ___ / 20
+Domain 4 Score: ___ / 20
+Domain 5 Score: ___ / 15
+
+Total Score:    ___ / 100
+
+Rating: _________________
+
+Assessment Date: ____________
+Assessor: ____________
+Next Review Date: ____________
+```

package/skills/salesforce/salesforce-org-assessment-skill/references/risk-register-template.md

@@ -0,0 +1,211 @@
+# Risk Register Template Reference
+
+Template for documenting findings during Salesforce org assessments with
+severity tiering, matter taxonomy, and remediation priority guidance.
+
+---
+
+## Finding Record Structure
+
+Each finding should be recorded with the following fields:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| Finding ID | Text | Sequential identifier (e.g., `SF-2026-001`) |
+| Title | Text | Short descriptive title (< 80 characters) |
+| Matter Type | Picklist | Taxonomy category (see below) |
+| Domain | Picklist | Assessment domain |
+| Severity | Picklist | CRITICAL / HIGH / MEDIUM / LOW / INFO |
+| CVSS-Like Score | Number 1-10 | Risk scoring |
+| Affected Component | Text | Object, field, class, or feature name |
+| Evidence | Long Text | How the finding was identified |
+| Impact | Long Text | What could happen if not remediated |
+| Recommendation | Long Text | Specific remediation steps |
+| Effort to Remediate | Picklist | Days / Weeks / Months |
+| Remediation Owner | Text | Team or individual responsible |
+| Target Resolution Date | Date | Based on severity SLA |
+| Status | Picklist | Open / In Progress / Remediated / Accepted Risk |
+| Accepted Risk Justification | Long Text | Required if Status = Accepted Risk |
+
+---
+
+## Matter Type Taxonomy
+
+Consistent classification enables trend analysis across multiple assessments.
+
+| Code | Matter Type | Description |
+|------|-------------|-------------|
+| ACC | Access Control | Permissions, profiles, permission sets, sharing |
+| AUTH | Authentication | MFA, session security, login controls |
+| DATA | Data Exposure | Sensitive data accessible to unauthorized users |
+| CODE | Code Quality | Apex/LWC security or performance issues |
+| INT | Integration Security | Connected app, OAuth, Named Credential issues |
+| FLOW | Automation | Flow, Process Builder, Workflow Rule issues |
+| COMP | Compliance | GDPR, CCPA, HIPAA, CASL, SOC 2 alignment |
+| CONF | Configuration | Security settings, network access, CSP |
+| DEPR | Deprecated Technology | Legacy automation, end-of-life APIs |
+| DEBT | Technical Debt | Code quality, field bloat, unused metadata |
+| MON | Monitoring | Audit trail, alerting, observability |
+| RESIL | Resilience | Error handling, retry, fault paths |
+
+---
+
+## Severity Definitions
+
+### CRITICAL
+
+Immediate exploitation risk or active data exposure. Requires emergency response.
+
+Examples:
+- `ModifyAllData` permission granted to integration user with no IP restriction.
+- SOQL injection vulnerability in public-facing REST endpoint.
+- PII field accessible via Guest User profile.
+- OAuth Username-Password Flow enabled and in use in production.
+
+**Remediation SLA:** Within 48 hours of identification.
+
+### HIGH
+
+Significant security risk or compliance gap. Requires priority remediation.
+
+Examples:
+- System Administrator profile assigned to > 10% of active users.
+- No MFA enforcement for internal users.
+- Callout credentials hardcoded in Apex source.
+- Shield Encryption not configured for regulated PII fields.
+- Active Workflow Rules with no migration plan.
+
+**Remediation SLA:** Within 14 business days.
+
+### MEDIUM
+
+Notable risk or quality concern. Should be remediated in next planning cycle.
+
+Examples:
+- Custom object OWD set to Public Read/Write without documented rationale.
+- Named Credential exists without credential rotation schedule.
+- Flow missing fault path on a non-critical email action.
+- Custom field count approaching 100 on Account.
+
+**Remediation SLA:** Within 90 days.
+
+### LOW
+
+Minor hygiene or best-practice deviation. Address in next cleanup sprint.
+
+Examples:
+- Custom fields lacking Description text.
+- Apex classes missing ApexDoc comments on public methods.
+- Inactive flow versions not cleaned up.
+
+**Remediation SLA:** Next scheduled maintenance window.
+
+### INFO
+
+Informational observation. No immediate action required.
+
+Examples:
+- Org is running Salesforce Classic for 5% of users (monitoring recommended).
+- Third-party managed package 1 minor version behind (monitor for update).
+
+**Remediation SLA:** Note for next assessment.
+
+---
+
+## Risk Scoring Matrix (CVSS-Like)
+
+Score = (Impact × 0.6) + (Likelihood × 0.4)
+
+Where:
+- **Impact:** 1 (minimal) to 5 (catastrophic)
+- **Likelihood:** 1 (theoretical) to 5 (actively exploited)
+
+| Score | Severity |
+|-------|---------|
+| 9-10 | CRITICAL |
+| 7-8.9 | HIGH |
+| 4-6.9 | MEDIUM |
+| 1-3.9 | LOW |
+
+---
+
+## Finding Record Template
+
+```
+FINDING ID: SF-YYYY-NNN
+TITLE: [Short descriptive title]
+MATTER TYPE: [ACC / AUTH / DATA / CODE / INT / FLOW / COMP / CONF / DEPR / DEBT / MON / RESIL]
+DOMAIN: [Access and Identity / Object Model / Automation / Integrations / Data Compliance]
+SEVERITY: [CRITICAL / HIGH / MEDIUM / LOW / INFO]
+RISK SCORE: [1-10]
+
+AFFECTED COMPONENT:
+[Object name, field API name, Apex class, Flow name, setting path]
+
+EVIDENCE:
+[How was this identified? Query results, screenshot reference, file path]
+
+Example query result:
+  SELECT COUNT(Id) FROM User WHERE Profile.Name = 'System Administrator'
+    AND IsActive = true
+  Result: 47 (expected: < 5)
+
+IMPACT:
+[What risk does this create? Data exposure, compliance gap, reliability issue]
+
+RECOMMENDATION:
+[Specific steps to remediate. Reference official documentation or this skill's
+references/ files where relevant]
+
+Step 1: [Action]
+Step 2: [Action]
+Step 3: [Verification]
+
+EFFORT TO REMEDIATE: [< 1 day / 1-3 days / 1-2 weeks / > 2 weeks]
+REMEDIATION OWNER: [Team or role]
+TARGET RESOLUTION DATE: [Based on severity SLA from identification date]
+STATUS: Open
+```
+
+---
+
+## Sample Completed Finding
+
+```
+FINDING ID: SF-2026-001
+TITLE: OAuth Username-Password Flow Enabled in Production
+MATTER TYPE: AUTH
+DOMAIN: Integrations and Callouts
+SEVERITY: CRITICAL
+RISK SCORE: 9.2
+
+AFFECTED COMPONENT:
+Setup > Apps > Connected Apps > [App Name] > Edit OAuth Policies
+Setting: Permitted Users = "All users may self-authorize"
+OAuth Flow: Username-Password enabled
+
+EVIDENCE:
+Reviewed Connected App OAuth policy configuration.
+Username-Password Flow was confirmed active.
+4 active integrations were identified using this flow pattern.
+
+IMPACT:
+The Username-Password OAuth flow transmits credentials in the API request body.
+This bypasses MFA enforcement. A credential leak exposes production org access
+without any additional authentication factor. This also violates OAuth 2.1
+deprecation of the resource owner password flow.
+
+RECOMMENDATION:
+Step 1: Audit all integrations using Username-Password flow (grep integration
+        code for grant_type=password).
+Step 2: Migrate each integration to JWT Bearer Flow (server-to-server) or
+        Authorization Code Flow with PKCE (user-facing).
+Step 3: Disable Username-Password Flow in the Connected App OAuth policy.
+Step 4: Rotate all credentials that were used in the Username-Password flow.
+Step 5: Verify no new logins via Username-Password flow in Login History.
+
+EFFORT TO REMEDIATE: 1-2 weeks (per integration)
+REMEDIATION OWNER: Integration Platform Team
+TARGET RESOLUTION DATE: [Identification date + 14 business days]
+STATUS: Open
+```