@raishin/vanguard-frontier-agentic 3.6.0 → 3.7.0

package/skills/qa/playwright-e2e-suite-review/SKILL.md

@@ -3,7 +3,7 @@ name: playwright-e2e-suite-review
 description: Use this skill when reviewing a Playwright end-to-end test suite for flakiness, selector brittleness, isolation defects, and CI reliability. Trigger when a user provides Playwright spec files, a playwright.config.ts/js, a CI workflow that runs Playwright, or asks why their E2E suite is flaky, slow, or fails intermittently in CI but passes locally. This skill reviews test artifacts statically; it does not execute the suite or launch browsers.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: delivery

package/skills/qa/playwright-e2e-suite-review/metadata.json

@@ -18,6 +18,6 @@
   "security_notes": "Static review only — reads test specs and config, never executes the suite, launches browsers, or contacts a target application. Never request or accept live application URLs with embedded credentials, auth tokens, real storageState files, or .env secrets; ask for sanitized snippets.",
   "last_verified": "2026-05-17",
   "path": "skills/qa/playwright-e2e-suite-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/qa/plc-control-logic-safety-review/SKILL.md

@@ -3,7 +3,7 @@ name: plc-control-logic-safety-review
 description: Use this skill when reviewing exported PLC program logic (Ladder Diagram, Structured Text, Function Block Diagram, or Sequential Function Chart) for safety and reliability defects. Trigger when a user provides exported IEC 61131-3 program source, an I/O list, a safety requirements spec, a SIL assessment, or asks whether their PLC logic has a safe state, a correct E-stop implementation, unresolved latches, forced I/O, or interlock bypass risks. This is OT/ICS — defects injure people or destroy equipment. The skill performs static review only; it never connects to a live PLC, never writes to a controller, and never advises modifying running logic or bypassing a safety function.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: resilience

package/skills/qa/plc-control-logic-safety-review/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Static review only — reads exported program logic, never connects to a live PLC, never writes to a controller, and never advises modifying running logic or bypassing a safety function. Never request or accept live controller IP addresses, plant network credentials, historian credentials, or any identifier that maps to a production asset. Ask for sanitized, anonymized exports only.",
   "last_verified": "2026-05-17",
   "path": "skills/qa/plc-control-logic-safety-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/qa/rpa-workflow-resilience-review/SKILL.md

@@ -3,7 +3,7 @@ name: rpa-workflow-resilience-review
 description: Use this skill when reviewing exported RPA workflow definitions for resilience and security defects that cause unattended bots to fail silently in production. Trigger when a user provides UiPath XAML files, Automation Anywhere bot exports, Power Automate Desktop flow definitions, Blue Prism process XML, or project dependency manifests, or asks why an unattended bot crashes silently, double-processes transactions, or times out under load. This skill reviews workflow definitions statically; it never connects to a live orchestrator, never runs a bot, and never requests runner credentials or orchestrator URLs.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: resilience

package/skills/qa/rpa-workflow-resilience-review/metadata.json

@@ -17,6 +17,6 @@
   "security_notes": "Static review only — reads exported workflow definitions, never connects to a live orchestrator, never executes a bot, and never requests runner credentials, orchestrator URLs, or production queue data. Never accept workflow exports containing live PII, real customer data, or production connection strings; ask for sanitized snippets.",
   "last_verified": "2026-05-17",
   "path": "skills/qa/rpa-workflow-resilience-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/qa/test-coverage-quality-review/SKILL.md

@@ -3,7 +3,7 @@ name: test-coverage-quality-review
 description: Use this skill when reviewing a test suite for assertion quality rather than coverage percentage — detecting coverage theater, where line/branch coverage is high but the tests would not catch a regression. Trigger when a user provides test files, a coverage report, or asks whether their tests are actually meaningful, why bugs ship despite high coverage, or how to set a coverage gate. This skill reviews test artifacts statically; it does not execute tests or run a coverage tool.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: delivery

package/skills/qa/test-coverage-quality-review/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Static review only — reads test source and coverage reports, never executes tests or runs a coverage tool. Never request or accept credentials, fixtures containing real customer data, or production database snapshots; ask for sanitized test code.",
   "last_verified": "2026-05-17",
   "path": "skills/qa/test-coverage-quality-review",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/qa/test-flakiness-triage/SKILL.md

@@ -3,7 +3,7 @@ name: test-flakiness-triage
 description: Use this skill when triaging flaky tests across any test framework — analyzing a flaky-test report, CI rerun history, or a set of intermittently failing tests to assign each a root-cause category and a remediation or quarantine path. Trigger when a user reports tests that pass on re-run, asks why CI is unreliable, provides a flaky-test dashboard export, or wants a quarantine policy. This skill reviews evidence statically; it does not execute or re-run tests.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-17"
   category: delivery

package/skills/qa/test-flakiness-triage/metadata.json

@@ -16,6 +16,6 @@
   "security_notes": "Static review only — analyzes failure logs, rerun history, and test source; never executes or re-runs tests. Never request or accept CI credentials, dashboard API tokens, or production data embedded in failure logs; ask for sanitized excerpts.",
   "last_verified": "2026-05-17",
   "path": "skills/qa/test-flakiness-triage",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/README.md

@@ -8,7 +8,7 @@ This directory contains **25** Salesforce domain skills curated for this marketp
 
 Provider: `salesforce`
 Lifecycle: `experimental`
-Author: `github: Raishin`
+Author: `github: VincentChuWaiChow`
 
 ---
 

package/skills/salesforce/salesforce-agentforce-risk-review-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-agentforce-risk-review-skill
 description: Use this skill when an Agentforce or Salesforce AI agent configuration must be reviewed for grounding quality, retrieval scope, action allowlist safety, human handoff design, hallucination containment, prompt injection surface, autonomous action boundary, audit logging, and model-risk controls. Trigger phrases: "review this Agentforce configuration", "assess the risk of this AI agent", "check the action allowlist for this agent", "review grounding and retrieval scope", "is this autonomous AI action safe". Do not use when the subject is a general Salesforce Flow or automation (use salesforce-flow-automation-review-skill), when a live Agentforce deployment is being pushed to production (use salesforce-live-change-approval-protocol), or when the focus is general Apex code quality (use salesforce-apex-lwc-code-review-skill). All Agentforce and Einstein feature names carryannotations; validate current terminology against official Salesforce documentation before use. Works from sanitized configuration exports only; never requests live org access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: ai

package/skills/salesforce/salesforce-agentforce-risk-review-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static configuration review; sanitized exports only; never executes agent actions or requests live org credentials. Autonomous action boundary violations always escalation-grade. All Agentforce product names require verification against current Salesforce documentation.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-agentforce-risk-review-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-agentforce-stdm-observer-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Queries Salesforce Telemetry & Data Management (STDM) and Data Clo
 license: MIT
 allowed-tools: Bash(sf data query:*) Bash(sf agent test:*) Bash(sf org display:*) Read Grep Glob Bash(sf api request:*) Bash(sf apex run:*)
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: 0.1.0
   updated: 2026-05-21
   category: operational

package/skills/salesforce/salesforce-agentforce-stdm-observer-skill/metadata.json

@@ -34,7 +34,7 @@
   "security_notes": "T1 read-only runtime. Aggregate-only output — session text content (user messages, agent responses, LLM prompts) is never emitted under any circumstance. All Salesforce record IDs are replaced with placeholders; record IDs in action invocations are hashed. User IDs and session participant IDs are replaced with placeholders. The cdp_query_api OAuth scope grants read-only Data Cloud query access only — no write access to Data Cloud. The Run As service account must have Manage Agentforce permission explicitly denied. Structured audit envelope emitted on every execution. Regulated-vertical orgs trigger mandatory escalation to salesforce-compliance-privacy-agent.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-agentforce-stdm-observer-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "companion_skills": ["salesforce-agentforce-risk-review-skill"],
   "verify_before_merge": "All Agentforce, STDM, Data Cloud, and Einstein AI feature names, DMO field names, object names, and API structures evolve rapidly. Validate all references against current official Salesforce documentation before production use. AiAgentTagAssociation, AiEvaluationDefinition, GenAiPlannerDefinition, and STDM DMO names are particularly prone to changes across releases."

package/skills/salesforce/salesforce-apex-generator-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Generates production-grade Apex classes with Service-Selector-Doma
 license: MIT
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: generation

package/skills/salesforce/salesforce-apex-generator-skill/metadata.json

@@ -25,6 +25,6 @@
   "security_notes": "T0 static generation only. No org connection, no OAuth, no secrets. All generated Apex uses with sharing by default; without sharing only where required by class type and documented with justification. Generated code applies WITH USER_MODE and Security.stripInaccessible() for user-data-touching classes. No hardcoded credentials, org IDs, or session tokens are ever generated. Output is draft code requiring human review before deployment.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-apex-generator-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-apex-log-analyzer-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Retrieves and analyzes Apex debug logs from a connected Salesforce
 license: MIT
 allowed-tools: Bash(sf apex get log:*) Bash(sf apex tail log:*) Bash(sf data query:*) Read Grep Glob Bash(sf org display:*)
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: operational

package/skills/salesforce/salesforce-apex-log-analyzer-skill/metadata.json

@@ -33,6 +33,6 @@
   "security_notes": "T1 read-only runtime. Log retrieval only — no code execution, no DML, no metadata mutation. Does not require View All Data (unlike salesforce-apex-test-runner-skill). OAuth scopes restricted to api + refresh_token. Apex debug logs may contain field values and PII; mandatory redaction of record IDs, user IDs, email addresses, and other PII fields before output. Session tokens and access tokens stripped from any log content. Structured audit envelope with pii_risk_assessed and redactions_applied fields emitted on every execution. Production org logs permitted but trigger maximum PII redaction scrutiny. Rotating the Run As account's refresh token immediately revokes all access.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-apex-log-analyzer-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-apex-lwc-code-review-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-apex-lwc-code-review-skill
 description: Use this skill when Salesforce Apex classes, triggers, Lightning Web Components (LWC), or async jobs (Queueable, Batch, Future, Schedulable) must be reviewed for security vulnerabilities and governor-limit risk. Flags: SOQL and DML inside loops, missing test coverage patterns, WITH SECURITY_ENFORCED or WITH USER_MODE or stripInaccessible usage, sharing keyword omission, governor-limit risk, LWC XSS surface, and Locker Service issues. Trigger phrases: "review this Apex class", "check this trigger for SOQL in loops", "is this LWC safe", "review this batch job", "check sharing enforcement in this code". Do not use when Flow automation (not code) is the primary subject (use salesforce-flow-automation-review-skill), when metadata quality is the focus (use salesforce-metadata-review-skill), or when a live code deployment is proposed (use salesforce-live-change-approval-protocol). Works from pasted code only; never requests live org access or executes code.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: security

package/skills/salesforce/salesforce-apex-lwc-code-review-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static code review; sanitized code only; never executes code or requests live org credentials. Refuses inputs with hardcoded credentials or customer data. without-sharing usage on PII classes always escalated for human review.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-apex-lwc-code-review-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-apex-test-generator-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Generates Apex test classes with TestDataFactory patterns, Assert
 license: MIT
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: generation

package/skills/salesforce/salesforce-apex-test-generator-skill/metadata.json

@@ -24,6 +24,6 @@
   "security_notes": "T0 static generation only. No org connection, no OAuth, no secrets. Generated test classes use SeeAllData=false by default to ensure test isolation. No hardcoded credentials, org IDs, session tokens, or record IDs are generated. All test data created via factory methods. Output is draft code requiring human review before deployment.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-apex-test-generator-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-apex-test-runner-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Executes Apex tests against a connected SANDBOX org via sf apex ru
 license: MIT
 allowed-tools: Bash(sf apex run test:*) Bash(sf org display:*) Bash(sf apex get test:*) Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: operational

package/skills/salesforce/salesforce-apex-test-runner-skill/metadata.json

@@ -32,6 +32,6 @@
   "security_notes": "T1 read-only runtime. Sandbox-only — production org targets are hard-refused before any API call. The View All Data system permission required by sf apex run test must exist exclusively on the sandbox-only Run As service account and never on a production-eligible account. OAuth scopes restricted to api + refresh_token. No DML, no metadata mutation, no code deployment. All Salesforce IDs, user IDs, and OAuth tokens are redacted before output. Structured audit envelope emitted on every execution including refusals. Rotating the Run As sandbox account's refresh token immediately revokes all access.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-apex-test-runner-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-bulk-data-ops-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Generates scripts for Salesforce bulk data operations: mass owner
 license: MIT
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: generation

package/skills/salesforce/salesforce-bulk-data-ops-skill/metadata.json

@@ -24,6 +24,6 @@
   "security_notes": "T0 static-review only. No org connection, no CLI execution, no MCP calls. Hard-deletes are T3 prohibited — this skill only generates soft-delete patterns. All scripts use allOrNone=false for partial success. Sandbox dry-run via salesforce-deployment-validator-skill is required before production. Production execution requires human approval via salesforce-live-guard-agent. No hardcoded record IDs in generated scripts — dynamic SOQL lookup pattern used.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-bulk-data-ops-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-deployment-validator-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Runs `sf project deploy validate` against a SANDBOX or non-product
 license: MIT
 allowed-tools: Bash(sf project deploy validate:*) Bash(sf org display:*) Bash(sf apex run test:*) Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: 0.1.0
   updated: 2026-05-21
   category: operational

package/skills/salesforce/salesforce-deployment-validator-skill/metadata.json

@@ -32,6 +32,6 @@
   "security_notes": "T2 sandbox-mutating but reversible. sf project deploy validate makes no persistent changes — no commit path exists in this skill. Production org targets are hard-refused before any API call. Connected App allowlist enforces sandbox-only targeting. Every execution emits a structured audit envelope including on refusals. OAuth scopes restricted to api + refresh_token. Run As service account has Deploy (Metadata API) permission but is denied ModifyAllData (production), Customize Application (production), and Manage Connected Apps. Validated deployment IDs are transient — no metadata is altered in the target org.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-deployment-validator-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-devsecops-pipeline-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-devsecops-pipeline-skill
 description: Use this skill when Salesforce development pipelines must be reviewed for DevSecOps compliance — covering Salesforce Code Analyzer (SCA) finding triage and false positive review, sandbox data governance and PII masking strategy, change impact analysis across metadata dependencies and downstream automation, CI/CD security gate requirements, and DevOps Center deployment governance. Trigger phrases: "review SCA findings", "triage code analyzer results", "assess sandbox data masking", "review change impact", "audit DevSecOps pipeline", "check CI/CD security gates", "review Salesforce DevOps". Do not use when Apex or LWC code patterns are the focus (use salesforce-apex-lwc-code-review-skill), when release readiness approval is needed (use salesforce-release-readiness-skill), when a live deployment is being executed (use salesforce-live-change-approval-protocol), or when permission model changes are under review (use salesforce-permission-model-review-skill). Works from sanitized exports and tool outputs only; never requests live org access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: delivery

package/skills/salesforce/salesforce-devsecops-pipeline-skill/metadata.json

@@ -14,6 +14,6 @@
   "security_notes": "Read-only static review; sanitized inputs only; never requests live org credentials, session tokens, or API access. Risk register is advisory; remediation requires human authorization.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-devsecops-pipeline-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-field-mapping-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Maps CSV or spreadsheet column headers to Salesforce field API nam
 license: MIT
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: generation

package/skills/salesforce/salesforce-field-mapping-skill/metadata.json

@@ -24,6 +24,6 @@
   "security_notes": "T0 static-review only. No org connection, no CLI execution, no MCP calls. PII in user-provided sample data rows is not included in output — headers only. Upsert external ID fields must have the External ID attribute set in Salesforce Setup.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-field-mapping-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-flow-automation-review-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-flow-automation-review-skill
 description: Use this skill when Salesforce Flow XML, validation rules, approval processes, or record-triggered automation must be reviewed for correctness, safety, and maintainability. Flags recursion, ungoverned bypass flags, brittle null handling, missing fault paths, hardcoded recipients, before-save vs after-save misuse, and mixed Process Builder plus Flow plus Apex on same object. Trigger phrases: "review this Flow", "check this automation for recursion", "review this approval process", "is this validation rule safe", "review this record-triggered automation". Do not use when Apex code is the primary subject (use salesforce-apex-lwc-code-review-skill), when metadata quality (not logic) is the focus (use salesforce-metadata-review-skill), or when a live automation activation is proposed (use salesforce-live-change-approval-protocol). Works from pasted or exported automation definitions only; never requests live org access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: platform

package/skills/salesforce/salesforce-flow-automation-review-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static review; sanitized exports only; never requests live org credentials or API access. Hardcoded recipient values not repeated in output. Automation activation decisions require human-authorized change management.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-flow-automation-review-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-flow-debugger-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Diagnoses Salesforce Flow failures from pasted error messages or (
 license: MIT
 allowed-tools: Bash(sf data query:*) Bash(sf org list metadata:*) Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: operational

package/skills/salesforce/salesforce-flow-debugger-skill/metadata.json

@@ -30,6 +30,6 @@
   "security_notes": "Hybrid T0/T1 skill. T0 mode requires no org connection. T1 mode queries FlowInterviewLog read-only via sf data query under api + refresh_token scopes. Denied: ModifyAllData, ViewAllData, ViewEncryptedData, ModifyMetadata, AuthorApex. T1 mode prefers sandbox — production requires explicit acknowledgment. All record IDs, user IDs, and variable values are redacted before output. Structured audit envelope emitted on every T1 execution.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-flow-debugger-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-infrastructure-audit-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-infrastructure-audit-skill
 description: Use this skill when Salesforce infrastructure security posture must be audited — covering network security policies, trusted IP ranges, login IP ranges per profile, CSP Trusted Sites configuration, session security settings, sandbox isolation strategy, sandbox data-sensitivity alignment, Hyperforce deployment controls, and data residency commitments. Trigger phrases: "audit Salesforce infrastructure security", "review network policies", "check IP allowlist config", "assess sandbox isolation", "review session settings", "check Hyperforce security posture". Do not use when identity or IAM permissioning is the focus (use salesforce-permission-model-review-skill), when a live production change is being made (use salesforce-live-change-approval-protocol), or when zero-trust maturity scoring across NIST pillars is needed (use salesforce-zero-trust-maturity-skill). Works from sanitized config exports only; never requests live org access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: security

package/skills/salesforce/salesforce-infrastructure-audit-skill/metadata.json

@@ -14,6 +14,6 @@
   "security_notes": "Read-only static review; sanitized inputs only; never requests live org credentials, session tokens, or API access. Risk register is advisory; remediation requires human authorization.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-infrastructure-audit-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-integration-review-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-integration-review-skill
 description: Use this skill when a Salesforce integration design must be reviewed for API choice, middleware position, retry and idempotency patterns, error queue design, observability, secret handling, OAuth scope minimization, named credential vs callout patterns, and MuleSoft vs point-to-point architecture. Trigger phrases: "review this Salesforce integration", "is this API design safe", "check OAuth scope for this integration", "review our MuleSoft pattern", "assess this Platform Events design". Do not use when Apex code quality (not integration design) is the focus (use salesforce-apex-lwc-code-review-skill), when a live integration change is being deployed (use salesforce-live-change-approval-protocol), or when marketing data flows are the subject (use salesforce-marketing-consent-review-skill). Works from sanitized integration design documents only; never requests live credentials or direct API access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: architecture

package/skills/salesforce/salesforce-integration-review-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static design review; sanitized design documents only; never tests endpoints or requests live credentials. Full OAuth scope is always a Critical finding. Cross-org regulated-data transfers require DPA verification with legal counsel.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-integration-review-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-marketing-consent-review-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-marketing-consent-review-skill
 description: Use this skill when marketing data flows must be reviewed for consent capture, lawful basis, purpose limitation, preference center coverage, suppression list integrity, subscriber-key collision risk, deliverability authentication (SPF, DKIM, DMARC), and unsubscribe link integrity. Covers Marketing Cloud, Account Engagement (formerly Pardot), Data Cloud, and related marketing orchestration tools. Trigger phrases: "review our marketing consent model", "check this Marketing Cloud data flow for consent", "is our preference center compliant", "review subscriber key design", "check SPF and DKIM for our sending domain". Do not use when the subject is a general Salesforce integration not involving marketing data (use salesforce-integration-review-skill), when a live Marketing Cloud change is being deployed (use salesforce-live-change-approval-protocol), or when a data exposure event has occurred (use salesforce-data-exposure-escalation-protocol). Works from sanitized design documents and configuration exports only; never requests live credentials or accesses marketing accounts.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: compliance

package/skills/salesforce/salesforce-marketing-consent-review-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static review; sanitized design documents only; never accesses live Marketing Cloud accounts or APIs. Lawful basis findings require verification by qualified privacy counsel. Regulated-data marketing flows escalated to compliance review.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-marketing-consent-review-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-metadata-fetcher-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Fetches Salesforce metadata (objects, fields, flows, validation ru
 license: MIT
 allowed-tools: Bash(sf org list metadata:*) Bash(sf project retrieve:*) Bash(sf sobject describe:*) Bash(sf org display:*) Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: 0.1.0
   updated: 2026-05-21
   category: operational

package/skills/salesforce/salesforce-metadata-fetcher-skill/metadata.json

@@ -32,7 +32,7 @@
   "security_notes": "T1 read-only-runtime tier. Run As service account requires View Setup and Configuration only; ModifyAllData, ViewAllData, ViewEncryptedData, ModifyMetadata, AuthorApex, ManageConnectedApps, and Customize Application must be explicitly denied. Org IDs and user IDs never appear verbatim in output — always replaced with placeholders. REST describe paths preferred over sf project retrieve start to minimize permission footprint. Encrypted field values (Shield PE, PMLE) skipped entirely. URL-embedded credentials and Named Credential headers trigger immediate stop. Hardcoded session ID literals in Apex escalate to Critical before handoff. Regulated-vertical production orgs require explicit operator confirmation before any retrieval.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-metadata-fetcher-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0",
   "companion_review_skills": [
     "salesforce-metadata-review-skill",

package/skills/salesforce/salesforce-metadata-review-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-metadata-review-skill
 description: Use this skill when pasted or exported Salesforce metadata must be reviewed for over-customization, unused fields, hardcoded IDs, and deprecated metadata types. Covers: objects, fields, layouts, page layouts, Lightning record pages, profiles, permission sets, and sharing rules. Trigger phrases: "review this Salesforce metadata", "check this object definition", "are there deprecated metadata types here", "find hardcoded IDs in this profile", "review this permission set export". Do not use when you need a full org posture assessment (use salesforce-org-assessment-skill), when you need a permission model deep-dive across topology (use salesforce-permission-model-review-skill), or when you need to review automation logic (use salesforce-flow-automation-review-skill). Works from pasted or exported metadata only; never requests live org access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: platform

package/skills/salesforce/salesforce-metadata-review-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static review; sanitized metadata exports only; never requests live org credentials or API access. Hardcoded ID values not repeated in output. Regulated-vertical findings escalated to compliance specialist.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-metadata-review-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-org-assessment-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-org-assessment-skill
 description: Use this skill when a Salesforce org's overall posture must be assessed from sanitized exports — covering the object model, automation inventory, permission topology, integration map, and technical debt indicators. Produces a risk register and remediation backlog. Trigger phrases: "assess this Salesforce org", "review org health", "generate a risk register for this org", "what is the technical debt in this org", "review this metadata export for posture". Do not use when you need to review a single metadata type in depth (use salesforce-metadata-review-skill), when you need to review only permissions (use salesforce-permission-model-review-skill), or when a live production change is being proposed (use salesforce-live-change-approval-protocol). Works from sanitized exports only; never requests live org credentials or direct API access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: platform

package/skills/salesforce/salesforce-org-assessment-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static review; sanitized exports only; never requests live org credentials, session tokens, or API access. Risk register is advisory; remediation requires human authorization. Regulated-vertical findings escalated to compliance counsel.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-org-assessment-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-permission-model-review-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-permission-model-review-skill
 description: Use this skill when Salesforce profiles, permission sets, permission set groups, permission set licenses, muting permission sets, sharing rules, OWD, role hierarchy, IP restrictions, or session policies must be reviewed for toxic combinations and over-privilege. Flags: ModifyAllData with broad assignment, ViewAllData on PII objects, API Enabled without IP restriction, Customize Application outside admin profiles, and sharing-rule widening on regulated-data objects. Trigger phrases: "review this permission model", "check for toxic permission combinations", "is this permission set safe", "review sharing rules on this object", "assess our OWD and role hierarchy". Do not use when you need a full org posture review (use salesforce-org-assessment-skill), when metadata quality is the focus (use salesforce-metadata-review-skill), or when a live permission change is being proposed (use salesforce-live-change-approval-protocol). Works from sanitized exports only; never requests live org access.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: security

package/skills/salesforce/salesforce-permission-model-review-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only static review; sanitized exports only; never requests live org credentials or API access. Guest-user PII exposure always triggers escalation-protocol. Toxic combinations are objective findings requiring human-authorized remediation.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-permission-model-review-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-release-readiness-skill/SKILL.md

@@ -3,7 +3,7 @@ name: salesforce-release-readiness-skill
 description: Use this skill when a Salesforce release must be evaluated for deployment readiness. Covers: sandbox refresh strategy, source tracking state, package version diff, destructiveChanges.xml review, test coverage threshold verification, post-deploy steps, rollback plan, comms plan, and approval matrix. Trigger phrases: "is this release ready to deploy", "review the destructive changes for this release", "check our sandbox strategy", "validate the release checklist", "pre-deploy readiness review". Do not use when you need to approve a live production mutation at execution time (use salesforce-live-change-approval-protocol), when code quality is the focus (use salesforce-apex-lwc-code-review-skill), or when automation logic needs review (use salesforce-flow-automation-review-skill). Works from release artifacts and plans only; never requests live org access or executes deployments.
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-20"
   category: delivery

package/skills/salesforce/salesforce-release-readiness-skill/metadata.json

@@ -13,6 +13,6 @@
   "security_notes": "Read-only advisory assessment; sanitized release artifacts only; never requests live org credentials or executes deployments. Irreversible destructive changes always require documented rollback plan. Regulated-data field deletions escalated to compliance review.",
   "last_verified": "2026-05-20",
   "path": "skills/salesforce/salesforce-release-readiness-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-soql-explorer-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Executes read-only SOQL queries against a connected Salesforce org
 license: MIT
 allowed-tools: Bash(sf data query:*) Bash(sf org list:*) Bash(sf org display:*) Read Grep Glob Bash(sf sobject describe:*) Bash(jq:*)
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: operational

package/skills/salesforce/salesforce-soql-explorer-skill/metadata.json

@@ -30,6 +30,6 @@
   "security_notes": "T1 read-only operational scope only. No DML permitted. OAuth scopes restricted to api + refresh_token. Run As service account has no ModifyAllData, ViewAllData, ViewEncryptedData, ModifyMetadata, AuthorApex, or ManageConnectedApps permissions. Org allowlist enforced by Connected App. Every execution emits a structured audit envelope. All Salesforce IDs, user IDs, and PII fields are redacted before output. Refresh token rotation immediately revokes access. Regulated-vertical orgs (Health Cloud, Financial Services Cloud) trigger mandatory compliance escalation.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-soql-explorer-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-soql-generator-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Generates SOQL queries from natural-language requirements without
 license: MIT
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: 0.1.0
   updated: 2026-05-21
   category: generation

package/skills/salesforce/salesforce-soql-generator-skill/metadata.json

@@ -20,6 +20,6 @@
   "security_notes": "T0 static-review only. No org connection, no OAuth, no MCP calls. Purely generative — emits query text for human review before any live execution. No secrets, credentials, or org data handled. Handoff to salesforce-soql-explorer-skill for live execution under T1 least-privilege scope.",
   "last_verified": "2026-05-21",
   "path": "skills/salesforce/salesforce-soql-generator-skill",
-  "author": "github: Raishin",
+  "author": "github: VincentChuWaiChow",
   "version": "0.1.0"
 }

package/skills/salesforce/salesforce-validation-rule-writer-skill/SKILL.md

@@ -4,7 +4,7 @@ description: "Converts business rules described in plain English into deployable
 license: MIT
 allowed-tools: Read Grep Glob
 metadata:
-  author: "github: Raishin"
+  author: "github: VincentChuWaiChow"
   version: "0.1.0"
   updated: "2026-05-21"
   category: generation