@salesforce/afv-skills 1.45.0 → 1.46.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/afv-skills",
-  "version": "1.45.0",
+  "version": "1.46.0",
   "description": "Salesforce skills for Agentforce Vibes",
   "license": "CC-BY-NC-4.0",
   "files": [

package/skills/automation-flow-generate/SKILL.md

@@ -78,11 +78,10 @@ Generates flow metadata element by element. This step is **mandatory** and must
 - **result** (STRING): Result of the flow element generation. Contains the final flow metadata **only when `isComplete` is `true`**.
 
 **MANDATORY: Loop until complete. NEVER pause or ask the user to confirm continuation.**
-- A flow can have **any number of elements** (10, 15, or more). Each call generates one element at a time, so you may need **many** iterations. This is expected and normal.
+- A flow can have **any number of elements**. Each call generates one element at a time, so you may need **many** iterations.
 - Call `flowElementGeneration` with the `operationId` from Step 2 and `requestSource` (use `"A4V"` for XML output, empty string or other value for JSON).
 - Check the `isComplete` output and the `result` field after each call.
-- If `isComplete` is `false` **and no errors are returned**, you **MUST** call `flowElementGeneration` again with the **same `operationId`** from Step 2. **Do NOT ask the user if they want to continue. Do NOT pause. Do NOT summarize progress mid-loop. Just keep calling.**
-- **Do NOT stop** until `isComplete` is `true` **or** the invocable action returns errors. There is **no maximum** number of iterations — keep going regardless of how many calls it takes.
+- If `isComplete` is `false` **and no errors are returned**, you **MUST** call `flowElementGeneration` again with the **same `operationId`** from Step 2. **Do NOT ask the user if they want to continue. Do NOT pause. Do NOT summarize progress mid-loop. Just keep calling** — there is **no maximum** number of iterations.
 - When `isComplete` is `true`, extract the flow metadata from the `result` field.
 - If errors are returned, stop the loop and surface the error to the user.
 
@@ -91,6 +90,8 @@ Generates flow metadata element by element. This step is **mandatory** and must
 - DO NOT add new nodes, tags, attributes, or text (do not add missing labels, X/Y coordinates, etc.).
 - DO NOT remove any existing nodes.
 
+**Canvas mode.** A net-new canvas-based flow needs a `<processMetadataValues>` `CanvasMode`=`AUTO_LAYOUT_CANVAS` entry (independent of `BuilderType`) or it opens in **Free-Form**. STRICT CONSTRAINTS forbid hand-editing the XML, so this must come from the generation pipeline — if the returned XML lacks it, surface a pipeline gap; do NOT hand-edit. (Non-canvas types like `CustomerLifecycle` carry none — don't flag those.)
+
 ## inflightMetadata Format
 **DATA TYPE: ARRAY (not string)**
 
@@ -208,6 +209,10 @@ To select records for a scheduled flow, put the record criteria in the **start e
 
 When the prompt says "runs once a week / every Sunday / daily at a time", the `userPrompt` should state: scheduled trigger, the frequency, the start time, and the record filter on the triggering object.
 
+### "Autolaunched" is literal
+
+An **"autolaunched"**/"no-trigger" request builds a **no-trigger** flow (no `triggerType`, `object`, or `<schedule>` on start) — put "for each…/when X"/timing intent in the **body**, not the trigger; add one only if asked.
+
 ### Counting related records ("count all related X", "number of X")
 
 To store a count of records, use a **single** assignment element with `<operator>AssignCount</operator>`, assigning from the collection (the record-lookup result) into a Number variable. Do NOT emit two assignment elements for one count, and do NOT give two assignment elements the same `name` — duplicate assignment names, or two assignments doing one logical count, fail deployment. One lookup → one `AssignCount` assignment → one record update.
@@ -299,7 +304,7 @@ Then call Step 2 and Step 3 for this flow.
   "requestSource": "A4V"
 }
 ```
-Call repeatedly with the same `operationId` until `isComplete` is `true` or errors are returned. A flow can have any number of elements, so expect multiple iterations. When `isComplete` is `true`, extract the flow metadata from the `result` field. Use `"requestSource": "A4V"` to get flow metadata in XML format.
+Loop as in Step 3 (same `operationId`, `requestSource: "A4V"`) until `isComplete` is `true` or errors return; extract the XML from `result` then.
 
 **Example 2: With custom objects from local sfdx project**
 
@@ -348,7 +353,7 @@ Call repeatedly with the same `operationId` until `isComplete` is `true` or erro
   "requestSource": "A4V"
 }
 ```
-Call repeatedly with the same `operationId` until `isComplete` is `true` or errors are returned. A flow can have any number of elements, so expect multiple iterations. When `isComplete` is `true`, extract the flow metadata from the `result` field. Use `"requestSource": "A4V"` to get flow metadata in XML format.
+Loop exactly as in Example 1's Step 3.
 
 ## CRITICAL Verification Checklist (MUST VERIFY BEFORE AND AFTER EVERY FLOW GENERATION)
 
@@ -361,3 +366,4 @@ Call repeatedly with the same `operationId` until `isComplete` is `true` or erro
 - [ ] **groundingMetadata** from Step 1 output is passed directly to Step 2 input (already a string — do NOT serialize it again).
 - [ ] **Step 3** is called in a loop with the same `operationId` from Step 2, `requestSource` always `"A4V"`, until `isComplete` is `true` or errors are returned — no pausing, no asking the user to continue, no matter how many iterations. Extract the XML from `result` only when `isComplete` is `true`.
 - [ ] **Multi-flow**: Each flow's full pipeline is completed before starting the next, SEQUENTIALLY (never in parallel, never interleaved), and ALL requested flows are generated — do NOT stop after the first.
+- [ ] **Canvas mode (read-only)**: a canvas-based net-new flow's XML carries a `<processMetadataValues>` `CanvasMode`=`AUTO_LAYOUT_CANVAS` entry. If absent, surface a pipeline gap — do NOT hand-edit (STRICT CONSTRAINTS forbid it). Non-canvas types like `CustomerLifecycle` carry none — don't flag those.

package/skills/dx-code-analyzer-configure/scripts/validate-config.sh

@@ -37,10 +37,11 @@ fi
 # Basic YAML syntax check (if python3 available)
 if command -v python3 &> /dev/null; then
     echo "Checking YAML syntax..."
-    if python3 -c "
+    if python3 - "$CONFIG_FILE" 2>&1 <<'PYEOF'; then
 import yaml, sys
+config_file = sys.argv[1]
 try:
-    with open('${CONFIG_FILE}', 'r') as f:
+    with open(config_file, 'r') as f:
         config = yaml.safe_load(f)
     if config is None:
         print('WARNING: Config file is empty or contains only comments')
@@ -50,10 +51,10 @@ try:
         sys.exit(1)
     print('YAML syntax: OK')
 except yaml.YAMLError as e:
-    print(f'ERROR: Invalid YAML syntax')
+    print('ERROR: Invalid YAML syntax')
     print(f'  {e}')
     sys.exit(1)
-" 2>&1; then
+PYEOF
         echo ""
     else
         echo ""
@@ -69,16 +70,19 @@ echo "Checking known fields..."
 VALID_TOP_LEVEL="config_root log_folder log_level rules engines ignores suppressions"
 
 if command -v python3 &> /dev/null; then
-    python3 -c "
+    python3 - "$CONFIG_FILE" "$VALID_TOP_LEVEL" 2>&1 <<'PYEOF'
 import yaml, sys
 
-with open('${CONFIG_FILE}', 'r') as f:
+config_file = sys.argv[1]
+valid_top_level = sys.argv[2]
+
+with open(config_file, 'r') as f:
     config = yaml.safe_load(f)
 
 if config is None:
     sys.exit(0)
 
-valid_fields = set('${VALID_TOP_LEVEL}'.split())
+valid_fields = set(valid_top_level.split())
 unknown = set(config.keys()) - valid_fields
 if unknown:
     print(f'WARNING: Unknown top-level fields: {sorted(unknown)}')
@@ -100,12 +104,12 @@ if 'engines' in config and config['engines']:
 # Check ignores section
 if 'ignores' in config and config['ignores']:
     if 'files' not in config['ignores']:
-        print('WARNING: ignores section should contain a \"files\" list')
+        print('WARNING: ignores section should contain a "files" list')
     elif not isinstance(config['ignores']['files'], list):
         print('ERROR: ignores.files must be a list of glob patterns')
         sys.exit(1)
     else:
-        print(f'Ignore patterns: {len(config[\"ignores\"][\"files\"])} patterns configured')
+        print(f'Ignore patterns: {len(config["ignores"]["files"])} patterns configured')
 
 # Check rules section
 if 'rules' in config and config['rules']:
@@ -120,7 +124,7 @@ if 'rules' in config and config['rules']:
                             print(f'WARNING: rules.{engine}.{rule_name}.severity = {sev} (expected 1-5 or Critical/High/Moderate/Low/Info)')
 
 print('')
-" 2>&1
+PYEOF
 fi
 
 # Run sf code-analyzer config validation (if sf CLI available)

package/skills/dx-code-analyzer-run/scripts/apply-fixes.js

@@ -15,14 +15,55 @@ const filePath = process.argv[2];
 const data = JSON.parse(fs.readFileSync(filePath, "utf8"));
 const runDir = data.runDir || "";
 
-// Group fixes by file
+// Fix targets are confined to the current working directory (the project being
+// fixed). loc.file and runDir come from the results JSON and are untrusted;
+// resolving each target against cwd and rejecting anything that escapes it
+// stops a crafted results file from writing arbitrary paths (e.g. /etc/passwd
+// or ../../outside-project).
+const baseDir = fs.realpathSync(process.cwd());
+
+function isOutside(base, target) {
+  const rel = path.relative(base, target);
+  return rel === "" || rel.startsWith("..") || path.isAbsolute(rel);
+}
+
+function safeResolve(candidate) {
+  if (typeof candidate !== "string" || !candidate) return null;
+  let rel = candidate;
+  // Engine output often uses absolute paths under the scan runDir; normalize
+  // those to project-relative before confinement.
+  if (runDir && rel.startsWith(runDir)) rel = rel.substring(runDir.length + 1);
+  const resolved = path.resolve(baseDir, rel);
+  // Lexical guard: rejects absolute paths and `..` traversal.
+  if (isOutside(baseDir, resolved)) return null;
+  // Symlink-aware guard: path.resolve/relative do not follow symlinks, so a
+  // symlinked path component (e.g. `link/victim` where `link` -> outside the
+  // tree) would pass the lexical check and let writeFileSync escape. Fix
+  // targets are read before being written, so the file exists — resolve its
+  // real path and re-check. Writing to the realpath also avoids following a
+  // symlink at write time. A missing target (realpathSync throws) is skipped.
+  let real;
+  try {
+    real = fs.realpathSync(resolved);
+  } catch {
+    return null;
+  }
+  if (isOutside(baseDir, real)) return null;
+  return real;
+}
+
+// Group fixes by confined, absolute file path
 const fileFixesMap = new Map();
+let fixesSkippedUnsafe = 0;
 data.violations.forEach(v => {
   if (v.fixes && v.fixes.length > 0) {
     v.fixes.forEach(fix => {
       const loc = fix.location;
-      let filePath = loc.file;
-      if (runDir && filePath.startsWith(runDir)) filePath = filePath.substring(runDir.length + 1);
+      const filePath = safeResolve(loc.file);
+      if (!filePath) {
+        fixesSkippedUnsafe++;
+        return;
+      }
 
       if (!fileFixesMap.has(filePath)) fileFixesMap.set(filePath, []);
       fileFixesMap.get(filePath).push({
@@ -83,4 +124,4 @@ fileFixesMap.forEach((fixes, filePath) => {
   }
 });
 
-console.log(JSON.stringify({ success: true, filesModified, fixesApplied, fixesSkipped, totalFixableFiles: fileFixesMap.size }));
+console.log(JSON.stringify({ success: true, filesModified, fixesApplied, fixesSkipped, fixesSkippedUnsafe, totalFixableFiles: fileFixesMap.size }));

package/skills/dx-code-analyzer-run/scripts/describe-rule.js

@@ -15,7 +15,32 @@
 //       resource:    https://...
 //       description: Some description text
 
-const { execSync } = require("child_process");
+const { execFileSync } = require("child_process");
+
+/**
+ * Run `sf code-analyzer rules ...` safely.
+ *
+ * Arguments are passed as an argv array (NOT a shell string), so a rule name
+ * or --engine value can never be interpreted as shell syntax. Returns the
+ * command's stdout as text; never throws (a non-zero exit still yields the
+ * output the caller wants to parse).
+ */
+function runCodeAnalyzerRules(extraArgs) {
+  try {
+    return execFileSync("sf", ["code-analyzer", "rules", ...extraArgs], {
+      encoding: "utf8",
+      timeout: 60000,
+      maxBuffer: 2 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  } catch (err) {
+    // Preserve the original `2>&1` behavior: a non-zero exit that emitted
+    // partial stdout plus a diagnostic on stderr must surface BOTH streams, in
+    // order, so a genuine failure isn't misparsed as "rule not found".
+    const combined = String(err.stdout || "") + String(err.stderr || "");
+    return combined || (err.output && err.output.filter(Boolean).join("")) || "";
+  }
+}
 
 function printUsage() {
   console.error(`Usage: node describe-rule.js <rule-name> [--engine <engine>]
@@ -52,25 +77,21 @@ for (let i = 1; i < args.length; i++) {
 // Build the rule selector for the lookup
 const selector = engine ? `${engine}:${ruleName}` : ruleName;
 
-// Run `sf code-analyzer rules` with --view detail to get full rule info
-let rawOutput;
-try {
-  const cmd = `sf code-analyzer rules --rule-selector "${selector}" --view detail 2>&1`;
-  rawOutput = execSync(cmd, {
-    encoding: "utf8",
-    timeout: 60000,
-    maxBuffer: 2 * 1024 * 1024,
-  });
-} catch (err) {
-  // execSync throws on non-zero exit, but we still want the output
-  rawOutput = err.stdout || err.stderr || (err.output && err.output.join("")) || "";
-  if (!rawOutput) {
-    console.log(JSON.stringify({
-      status: "error",
-      message: `Failed to run sf code-analyzer rules: ${err.message}`,
-    }));
-    process.exit(0);
-  }
+// Run `sf code-analyzer rules` with --view detail to get full rule info.
+// `selector` is passed as a single argv element, so it cannot inject shell
+// commands even if it contains metacharacters.
+const rawOutput = runCodeAnalyzerRules([
+  "--rule-selector",
+  selector,
+  "--view",
+  "detail",
+]);
+if (!rawOutput) {
+  console.log(JSON.stringify({
+    status: "error",
+    message: `Failed to run sf code-analyzer rules for selector "${selector}"`,
+  }));
+  process.exit(0);
 }
 
 // Parse the detail view output
@@ -224,12 +245,16 @@ function parseDetailOutput(output) {
 function tryGrepFallback(ruleName, engine) {
   try {
     const sel = engine || "Recommended";
-    const cmd = `sf code-analyzer rules --rule-selector "${sel}" 2>&1 | grep -i "${ruleName}"`;
-    const grepOutput = execSync(cmd, {
-      encoding: "utf8",
-      timeout: 60000,
-      maxBuffer: 2 * 1024 * 1024,
-    });
+    const output = runCodeAnalyzerRules(["--rule-selector", sel]);
+
+    // Case-insensitive substring filter done in JS. Previously this shelled out
+    // to `... | grep -i "${ruleName}"`, interpolating the untrusted rule name
+    // into a shell command; matching here removes that injection sink.
+    const needle = ruleName.toLowerCase();
+    const grepOutput = output
+      .split("\n")
+      .filter((line) => line.toLowerCase().includes(needle))
+      .join("\n");
 
     if (!grepOutput.trim()) return null;
 
@@ -273,12 +298,7 @@ function tryGrepFallback(ruleName, engine) {
 function tryFuzzyFallback(ruleName, engine) {
   try {
     const sel = engine || "Recommended";
-    const cmd = `sf code-analyzer rules --rule-selector "${sel}" 2>&1`;
-    const output = execSync(cmd, {
-      encoding: "utf8",
-      timeout: 60000,
-      maxBuffer: 2 * 1024 * 1024,
-    });
+    const output = runCodeAnalyzerRules(["--rule-selector", sel]);
 
     // Extract rule names from table output
     // Lines with rule data have: index  name  engine  severity  tags

package/skills/platform-apex-logs-debug/SKILL.md

@@ -2,11 +2,8 @@
 name: platform-apex-logs-debug
 description: "Salesforce debug log analysis and troubleshooting with 100-point scoring. TRIGGER when: user analyzes debug logs, hits governor limits, reads stack traces, or touches .log files from Salesforce orgs. DO NOT TRIGGER when: running Apex tests (use platform-apex-test-run), generating or fixing Apex code (use platform-apex-generate), or Agentforce session tracing (use agentforce-observe)."
 metadata:
-  cliTools:
-    - tool: ["jq"]
-      semver: ">=1.6.0"
-    - tool: ["sf"]
-      semver: ">=2.0.0"
+  version: "1.1"
+  domains: ["Platform"]
   relatedSkills:
     - "agentforce-observe"
     - "platform-apex-generate"
@@ -14,8 +11,11 @@ metadata:
     - "platform-data-manage"
     - "platform-metadata-deploy"
     - "platform-soql-query"
-  version: "1.1"
-  domains: ["Platform"]
+  cliTools:
+    - tool: ["sf"]
+      semver: ">=2.0.0"
+    - tool: ["jq"]
+      semver: ">=1.6.0"
 ---
 
 # platform-apex-logs-debug: Salesforce Debug Log Analysis & Troubleshooting

package/skills/platform-custom-application-generate/SKILL.md

@@ -2,11 +2,11 @@
 name: platform-custom-application-generate
 description: "Use this skill when users need to create or configure tab-based Salesforce Custom Applications with navigation, branding, and action overrides. Trigger when users mention custom apps, application metadata, app navigation, or organizing tabs into applications. Use when users want to create app containers for tabs and pages. Do NOT use when the goal is hosting a React UI bundle in the App Launcher — use experience-ui-bundle-custom-app-generate for that case."
 metadata:
-  relatedSkills:
-    - "experience-ui-bundle-custom-app-generate"
   version: "1.0"
   domains: ["Platform"]
   minApiVersion: "60.0"
+  relatedSkills:
+    - "experience-ui-bundle-custom-app-generate"
 ---
 
 ## When to Use This Skill
@@ -48,8 +48,8 @@ Custom applications (Lightning Apps) that group tabs and functionality to provid
 - **description**: Brief description of the application's purpose
 - **tabs**: Array of tab names to include
 - **utilityBar**: API name of the Utility Bar configuration
-- **brand**: ⚠️ HIGHLY RECOMMENDED - Branding configuration object (headerColor, shouldOverrideOrgTheme, footerColor)
-- **actionOverrides**: ⚠️ REQUIRED when custom record pages exist - Action override configuration (actionName, content, formFactor, type, pageOrSobjectType)
+- **brand**: HIGHLY RECOMMENDED - Branding configuration object (headerColor, shouldOverrideOrgTheme, footerColor)
+- **actionOverrides**: REQUIRED when custom record pages exist - Action override configuration (actionName, content, formFactor, type, pageOrSobjectType)
 - **profileActionOverrides**: Profile-specific action overrides (actionName, content, formFactor, pageOrSobjectType, type, profile)
 - **isNavAutoTempTabsDisabled**: Navigation behavior setting (default: false)
 - **isNavPersonalizationDisabled**: Personalization setting (default: false)

package/skills/platform-custom-object-generate/SKILL.md

@@ -25,7 +25,7 @@ This document defines the mandatory constraints for generating CustomObject meta
 
 **File extension:** `.object-meta.xml`
 
-> **🔔 Description freshness — applies to EVERY object change, fields AND validation rules:** Whenever you add, update, or delete a field **or a validation rule** on an object, the `<description>` may now be stale. Before finishing, refresh it per **Section 3.B** (propose, confirm with the user, write). A validation-rule change counts exactly like a field change — the change is **not** done until the description has been reconciled. This is easy to forget on validation-rule edits/deletes — don't.
+> **Description freshness — applies to EVERY object change, fields AND validation rules:** Whenever you add, update, or delete a field **or a validation rule** on an object, the `<description>` may now be stale. Before finishing, refresh it per **Section 3.B** (propose, confirm with the user, write). A validation-rule change counts exactly like a field change — the change is **not** done until the description has been reconciled. This is easy to forget on validation-rule edits/deletes — don't.
 
 ---
 
@@ -57,7 +57,7 @@ The following constraints must be true for the XML body to deploy successfully.
 - IF object has Master-Detail field → use `ControlledByParent`
 - IF a Master-Detail field is being added to an existing child object → that existing object's `<sharingModel>` must also be updated to `ControlledByParent`
 
-**❌ INCORRECT** — Will cause error: `Cannot set sharingModel to ReadWrite on a CustomObject with a MasterDetail relationship field`
+**INCORRECT** — Will cause error: `Cannot set sharingModel to ReadWrite on a CustomObject with a MasterDetail relationship field`
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <label>Order Line Item</label>
@@ -67,7 +67,7 @@ The following constraints must be true for the XML body to deploy successfully.
 </CustomObject>
 ```
 
-**✅ CORRECT:**
+**CORRECT:**
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <label>Order Line Item</label>
@@ -191,7 +191,7 @@ Do not create more than **2 Master-Detail relationships** for a single object. I
 
 Do NOT include the `<fullName>` tag at the root of the `.object-meta.xml` file. The API name is derived from the filename.
 
-**❌ INCORRECT:**
+**INCORRECT:**
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <fullName>Vehicle__c</fullName>  <!-- WRONG: Remove this -->
@@ -199,7 +199,7 @@ Do NOT include the `<fullName>` tag at the root of the `.object-meta.xml` file.
 </CustomObject>
 ```
 
-**✅ CORRECT:**
+**CORRECT:**
 ```xml
 <CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">
   <label>Vehicle</label>
@@ -218,7 +218,7 @@ Validation rule names follow different conventions than custom fields.
 - Cannot contain two consecutive underscores
 - **Must NOT end with `__c`** (unlike custom fields)
 
-**❌ INCORRECT:**
+**INCORRECT:**
 ```xml
 <validationRules>
   <fullName>Require_Start_Date__c</fullName>  <!-- WRONG: Has __c suffix -->
@@ -229,7 +229,7 @@ Validation rule names follow different conventions than custom fields.
 ```
 **Error:** `The validation name can only contain alphanumeric characters, must begin with a letter, cannot end with an underscore...`
 
-**✅ CORRECT:**
+**CORRECT:**
 ```xml
 <validationRules>
   <fullName>Require_Start_Date</fullName>  <!-- CORRECT: No __c suffix -->

package/skills/platform-custom-tab-generate/SKILL.md

@@ -81,7 +81,7 @@ Also forbidden:
     <motif>Custom98: Truck</motif>
 </CustomTab>
 ```
-- **❌ WRONG** — do NOT add `<sobjectName>`, `<name>`, `<fullName>`, or `<label>`:
+- **WRONG** — do NOT add `<sobjectName>`, `<name>`, `<fullName>`, or `<label>`:
 ```xml
 <CustomTab xmlns="http://soap.sforce.com/2006/04/metadata">
     <sobjectName>Space_Station__c</sobjectName>  <!-- DEPLOYMENT ERROR -->

package/skills/platform-flexipage-generate/SKILL.md

@@ -11,6 +11,10 @@ metadata:
       semver: ">=3.10.0"
     - tool: ["sf"]
       semver: ">=2.126.4"
+  mcpTools:
+    metadata-experts:
+      tools: ["execute_metadata_action"]
+      semver: ">=1.0.0"
 ---
 
 ## When to Use This Skill

package/skills/platform-list-view-generate/SKILL.md

@@ -4,6 +4,7 @@ description: "Use this skill when users need to create, generate, or validate Sa
 metadata:
   version: "1.0"
   domains: ["Platform"]
+  minApiVersion: "51.0"
 ---
 
 ## When to Use This Skill

package/skills/platform-soql-query/SKILL.md

@@ -2,6 +2,14 @@
 name: platform-soql-query
 description: "SOQL query generation, optimization, and analysis with 100-point scoring. Use this skill when the user needs SOQL/SOSL authoring or optimization: natural-language-to-query generation, relationship queries, aggregates, query-plan analysis, and performance or safety improvements for Salesforce queries. TRIGGER when: user writes, optimizes, or debugs SOQL/SOSL queries, touches .soql files, or asks about relationship queries, aggregates, or query performance. DO NOT TRIGGER when: bulk data operations (use platform-data-manage), Apex DML logic (use platform-apex-generate), or report/dashboard queries."
 metadata:
+  version: "1.1"
+  domains: ["Platform"]
+  relatedSkills:
+    - "experience-lwc-generate"
+    - "platform-apex-generate"
+    - "platform-apex-logs-debug"
+    - "platform-apex-test-run"
+    - "platform-data-manage"
   cliTools:
     - tool: ["jq"]
       semver: ">=1.6.0"
@@ -9,14 +17,6 @@ metadata:
       semver: ">=3.10.0"
     - tool: ["sf"]
       semver: ">=2.0.0"
-  relatedSkills:
-    - "experience-lwc-generate"
-    - "platform-apex-generate"
-    - "platform-apex-logs-debug"
-    - "platform-apex-test-run"
-    - "platform-data-manage"
-  version: "1.1"
-  domains: ["Platform"]
 ---
 
 # platform-soql-query: Salesforce SOQL Query Expert

package/skills/platform-value-set-generate/SKILL.md

@@ -2,11 +2,11 @@
 name: platform-value-set-generate
 description: "Use this skill when users need to create, generate, or validate a Salesforce global value set or customize a standard value set. Trigger when users mention a global value set, GlobalValueSet, standard value set, StandardValueSet, a reusable picklist, a picklist value set shared across fields, or customizing standard picklists like Industry, Lead Source, or Opportunity Stage. Also use when users hit deployment errors adding values to a standard picklist, referencing a value set from a custom field, or working with .globalValueSet-meta.xml or .standardValueSet-meta.xml files. DO NOT TRIGGER for an inline one-off picklist on a single field with no reuse, or for general custom field metadata work that does not involve a GlobalValueSet or StandardValueSet — use platform-custom-field-generate instead."
 metadata:
-  relatedSkills:
-    - "platform-custom-field-generate"
   version: "1.0"
   domains: ["Platform"]
   minApiVersion: "60.0"
+  relatedSkills:
+    - "platform-custom-field-generate"
   cliTools:
     - tool: ["sf"]
       semver: ">=2.0.0"